dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'dougmorato-release_and_docs_wip'

Browse Source
This commit is contained in:
Nanne Baars 2015-09-18 00:25:04 +02:00
commit 0d543908f9
95 changed files with 13932 additions and 11513 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

267
pom.xml
View File

@ -1,19 +1,252 @@
<?xml version="1.0"?> <?xml version="1.0"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> <project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0"
<name>webgoat-parent</name> xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>org.owasp.webgoat</groupId> <modelVersion>4.0.0</modelVersion>
<artifactId>webgoat-parent</artifactId> <groupId>org.owasp.webgoat</groupId>
<packaging>pom</packaging> <artifactId>webgoat-parent</artifactId>
<version>7.0-SNAPSHOT</version> <packaging>pom</packaging>
<!-- Shared version number properties --> <version>7.0-SNAPSHOT</version>
<properties>
<!-- If run from Bamboo this will be replaced with the bamboo build number --> <name>WebGoat Parent Pom</name>
<build.number>local</build.number> <description>Parent Pom for the WebGoat Project. A deliberately insecure Web Application</description>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> <inceptionYear>2006</inceptionYear>
</properties> <url>https://github.com/WebGoat/WebGoat</url>
<modules>
<module>webgoat-container</module> <organization>
<module>webgoat-classloader</module> <name>OWASP</name>
</modules> <url>https://webgoat.github.io/</url>
</organization>
<licenses>
<license>
<name>GNU General Public License, version 2</name>
<url>https://www.gnu.org/licenses/gpl-2.0.txt</url>
</license>
</licenses>
<developers>
<developer>
<id>mayher64</id>
<name>Bruce Mayhew</name>
<email>webgoat@owasp.org</email>
<organization>OWASP</organization>
<organizationUrl>https://github.com/WebGoat/WebGoat</organizationUrl>
</developer>
<developer>
<id>nbaars</id>
<name>Nanne Baars</name>
<email>nbaars@xebia.com</email>
<organizationUrl>https://github.com/nbaars</organizationUrl>
<timezone>Europe/Amsterdam</timezone>
</developer>
<developer>
<id>misfir3</id>
<name></name>
<email></email>
</developer>
<developer>
<id>jwayman</id>
<name>Jeff Wayman</name>
<email></email>
</developer>
<developer>
<id>dcowden</id>
<name>Dave Cowden</name>
<email></email>
</developer>
<developer>
<id>lawson89</id>
<name>Richard Lawson</name>
<email></email>
</developer>
<developer>
<id>dougmorato</id>
<name>Doug Morato</name>
<email>doug.morato@owasp.org</email>
<organization>OWASP</organization>
<organizationUrl>https://github.com/dougmorato</organizationUrl>
<timezone>America/New_York</timezone>
<properties>
<picUrl>https://avatars2.githubusercontent.com/u/9654?v=3&amp;s=150</picUrl>
</properties>
</developer>
</developers>
<mailingLists>
<mailingList>
<name>OWASP WebGoat Mailing List</name>
<subscribe>https://lists.owasp.org/mailman/listinfo/owasp-webgoat</subscribe>
<unsubscribe>Owasp-webgoat-request@lists.owasp.org</unsubscribe>
<post>owasp-webgoat@lists.owasp.org</post>
<archive>http://lists.owasp.org/pipermail/owasp-webgoat/</archive>
</mailingList>
</mailingLists>
<scm>
<url>https://github.com/WebGoat/WebGoat</url>
<connection>scm:git:git@github.com:WebGoat/WebGoat.git</connection>
<developerConnection>scm:git:git@github.com:WebGoat/WebGoat.git</developerConnection>
</scm>
<issueManagement>
<system>Github Issues</system>
<url>https://github.com/WebGoat/WebGoat/issues</url>
</issueManagement>
<ciManagement>
<system>Travis CI</system>
<url>https://travis-ci.org/WebGoat/WebGoat</url>
</ciManagement>
<properties>
<!-- Use UTF-8 Encoding -->
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<!-- This build number will be ubdated by Travis-CI -->
<build.number>build</build.number>
<!-- Shared properties with plugins and version numbers across submodules-->
<activation.version>1.1</activation.version>
<axis-ant.version>1.2</axis-ant.version>
<axis-jaxrpc.version>1.2</axis-jaxrpc.version>
<axis-saaj.version>1.2</axis-saaj.version>
<axis.version>1.2</axis.version>
<build-helper-maven-plugin.version>1.7</build-helper-maven-plugin.version>
<commons-collections.version>3.1</commons-collections.version>
<commons-digester.version>1.8.1</commons-digester.version>
<commons-discovery.version>0.2</commons-discovery.version>
<commons-fileupload.version>1.2.2</commons-fileupload.version>
<commons-io.version>1.4</commons-io.version>
<commons-lang3.version>3.3.2</commons-lang3.version>
<commons-logging.version>1.1.3</commons-logging.version>
<ecs.version>1.4.2</ecs.version>
<guava.version>18.0</guava.version>
<h2.version>1.4.187</h2.version>
<hsqldb.version>1.8.0.10</hsqldb.version>
<j2h.version>1.3.1</j2h.version>
<jackson-core.version>2.0.4</jackson-core.version>
<jackson-databind.version>2.0.4</jackson-databind.version>
<javaee-api.version>6.0</javaee-api.version>
<javax.transaction-api.version>1.2</javax.transaction-api.version>
<jcl-over-slf4j.version>1.7.7</jcl-over-slf4j.version>
<jstl.version>1.2</jstl.version>
<jtds.version>1.2.2</jtds.version>
<junit.version>4.12</junit.version>
<log4j.version>1.2.17</log4j.version>
<mail.version>1.4.2</mail.version>
<maven-compiler-plugin.version>3.1</maven-compiler-plugin.version>
<maven-failsafe-plugin.version>2.18.1</maven-failsafe-plugin.version>
<maven-gpg-plugin.version>1.6</maven-gpg-plugin.version>
<maven-jar-plugin.version>2.6</maven-jar-plugin.version>
<maven-javadoc-plugin.version>2.10.3</maven-javadoc-plugin.version>
<maven-release-plugin.version>2.5.2</maven-release-plugin.version>
<maven-source-plugin.version>2.4</maven-source-plugin.version>
<maven-surefire-plugin.version>2.18.1</maven-surefire-plugin.version>
<maven-war-plugin.version>2.4</maven-war-plugin.version>
<nexus-staging-maven-plugin.version>1.6.6</nexus-staging-maven-plugin.version>
<org.springframework.version>3.2.4.RELEASE</org.springframework.version>
<sauce_junit.version>2.1.18</sauce_junit.version>
<selenium-java.version>2.47.1</selenium-java.version>
<slf4j-api.version>1.7.7</slf4j-api.version>
<slf4j-log4j12.version>1.7.7</slf4j-log4j12.version>
<spring.security.version>3.2.4.RELEASE</spring.security.version>
<standard.version>1.1.2</standard.version>
<tiles.version>2.2.2</tiles.version>
<tomcat7-maven-plugin.version>2.2</tomcat7-maven-plugin.version>
<wsdl4j.version>1.5.1</wsdl4j.version>
<tomcat-catalina.version>7.0.63</tomcat-catalina.version>
</properties>
<modules>
<module>webgoat-container</module>
<module>webgoat-classloader</module>
</modules>
<distributionManagement>
<snapshotRepository>
<id>ossrh</id>
<url>https://oss.sonatype.org/content/repositories/snapshots</url>
</snapshotRepository>
</distributionManagement>
<profiles>
<profile>
<id>release</id>
<build>
<plugins>
<plugin>
<groupId>org.sonatype.plugins</groupId>
<artifactId>nexus-staging-maven-plugin</artifactId>
<version>${nexus-staging-maven-plugin.version}</version>
<extensions>true</extensions>
<configuration>
<serverId>ossrh</serverId>
<nexusUrl>https://oss.sonatype.org/</nexusUrl>
<autoReleaseAfterClose>true</autoReleaseAfterClose>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-source-plugin</artifactId>
<version>${maven-source-plugin.version}</version>
<executions>
<execution>
<id>attach-sources</id>
<goals>
<goal>jar-no-fork</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
<version>${maven-javadoc-plugin.version}</version>
<executions>
<execution>
<id>attach-javadocs</id>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-gpg-plugin</artifactId>
<version>${maven-gpg-plugin.version}</version>
<executions>
<execution>
<id>sign-artifacts</id>
<phase>verify</phase>
<goals>
<goal>sign</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
</profile>
</profiles>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-release-plugin</artifactId>
<version>${maven-release-plugin.version}</version>
<configuration>
<autoVersionSubmodules>true</autoVersionSubmodules>
<useReleaseProfile>false</useReleaseProfile>
<releaseProfiles>release</releaseProfiles>
<tagNameFormat>@{project.version}</tagNameFormat>
<goals>deploy</goals>
</configuration>
</plugin>
</plugins>
</build>
</project> </project>

8
webgoat-classloader/pom.xml
View File

@ -1,9 +1,12 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<name>webgoat-classloader</name> <name>webgoat-classloader</name>
<modelVersion>4.0.0</modelVersion> <modelVersion>4.0.0</modelVersion>
<artifactId>webgoat-classloader</artifactId> <artifactId>webgoat-classloader</artifactId>
<packaging>jar</packaging> <packaging>jar</packaging>
<parent> <parent>
<groupId>org.owasp.webgoat</groupId> <groupId>org.owasp.webgoat</groupId>
<artifactId>webgoat-parent</artifactId> <artifactId>webgoat-parent</artifactId>
@ -15,7 +18,7 @@
<plugin> <plugin>
<groupId>org.apache.maven.plugins</groupId> <groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId> <artifactId>maven-compiler-plugin</artifactId>
<version>3.1</version> <version>${maven-compiler-plugin.version}</version>
<configuration> <configuration>
<source>1.7</source> <source>1.7</source>
<target>1.7</target> <target>1.7</target>
@ -29,9 +32,8 @@
<dependency> <dependency>
<groupId>org.apache.tomcat</groupId> <groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-catalina</artifactId> <artifactId>tomcat-catalina</artifactId>
<version>7.0.47</version> <version>${tomcat-catalina.version}</version>
</dependency> </dependency>
</dependencies> </dependencies>
</project> </project>

15
webgoat-classloader/src/main/java/org/owasp/webgoat/classloader/PluginClassLoader.java
View File

@ -14,15 +14,30 @@ import java.util.List;
* *
* With this loader we can add jars we load during the plugin loading and the jsp will pick it up because this is * With this loader we can add jars we load during the plugin loading and the jsp will pick it up because this is
* the same classloader. * the same classloader.
*
* @version $Id: $Id
*/ */
public class PluginClassLoader extends WebappClassLoader { public class PluginClassLoader extends WebappClassLoader {
/**
* <p>Constructor for PluginClassLoader.</p>
*/
public PluginClassLoader() { public PluginClassLoader() {
} }
/**
* <p>Constructor for PluginClassLoader.</p>
*
* @param parent a {@link java.lang.ClassLoader} object.
*/
public PluginClassLoader(ClassLoader parent) { public PluginClassLoader(ClassLoader parent) {
super(parent); super(parent);
} }
/**
* <p>addURL.</p>
*
* @param urls a {@link java.util.List} object.
*/
public void addURL(List<URL> urls) { public void addURL(List<URL> urls) {
for (URL url : urls) { for (URL url : urls) {
super.addURL(url); super.addURL(url);

110
webgoat-container/pom.xml
View File

@ -1,23 +1,18 @@
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" <?xml version="1.0" encoding="UTF-8"?>
<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<name>webgoat-container</name> <name>webgoat-container</name>
<modelVersion>4.0.0</modelVersion> <modelVersion>4.0.0</modelVersion>
<artifactId>webgoat-container</artifactId> <artifactId>webgoat-container</artifactId>
<packaging>war</packaging> <packaging>war</packaging>
<parent> <parent>
<groupId>org.owasp.webgoat</groupId> <groupId>org.owasp.webgoat</groupId>
<artifactId>webgoat-parent</artifactId> <artifactId>webgoat-parent</artifactId>
<version>7.0-SNAPSHOT</version> <version>7.0-SNAPSHOT</version>
</parent> </parent>
<!-- Shared version number properties -->
<properties>
<org.springframework.version>3.2.4.RELEASE</org.springframework.version>
<spring.security.version>3.2.4.RELEASE</spring.security.version>
<tiles.version>2.2.2</tiles.version>
</properties>
<profiles> <profiles>
<profile> <profile>
<id>run-integration-tests</id> <id>run-integration-tests</id>
@ -33,7 +28,7 @@
<plugin> <plugin>
<groupId>org.apache.tomcat.maven</groupId> <groupId>org.apache.tomcat.maven</groupId>
<artifactId>tomcat7-maven-plugin</artifactId> <artifactId>tomcat7-maven-plugin</artifactId>
<version>2.2</version> <version>${tomcat7-maven-plugin.version}</version>
<configuration> <configuration>
<server>local_tomcat</server> <server>local_tomcat</server>
<url>http://localhost:8080/manager</url> <url>http://localhost:8080/manager</url>
@ -73,7 +68,7 @@
</configuration> </configuration>
</execution> </execution>
<execution> <execution>
<id>start-tomcat</id> <id>tomcat-startup</id>
<phase>pre-integration-test</phase> <phase>pre-integration-test</phase>
<goals> <goals>
<goal>run-war-only</goal> <goal>run-war-only</goal>
@ -85,7 +80,7 @@
</execution> </execution>
<!-- At post-integration-test phase, stop the embedded Tomcat server. --> <!-- At post-integration-test phase, stop the embedded Tomcat server. -->
<execution> <execution>
<id>stop-tomcat</id> <id>tomcat-shutdown</id>
<phase>post-integration-test</phase> <phase>post-integration-test</phase>
<goals> <goals>
<goal>shutdown</goal> <goal>shutdown</goal>
@ -96,7 +91,7 @@
<plugin> <plugin>
<groupId>org.apache.maven.plugins</groupId> <groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-failsafe-plugin</artifactId> <artifactId>maven-failsafe-plugin</artifactId>
<version>2.18.1</version> <version>${maven-failsafe-plugin.version}</version>
<executions> <executions>
<execution> <execution>
<goals> <goals>
@ -124,7 +119,7 @@
<plugin> <plugin>
<groupId>org.apache.maven.plugins</groupId> <groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId> <artifactId>maven-compiler-plugin</artifactId>
<version>3.1</version> <version>${maven-compiler-plugin.version}</version>
<configuration> <configuration>
<source>1.7</source> <source>1.7</source>
<target>1.7</target> <target>1.7</target>
@ -134,7 +129,7 @@
<plugin> <plugin>
<groupId>org.apache.maven.plugins</groupId> <groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId> <artifactId>maven-jar-plugin</artifactId>
<version>2.6</version> <version>${maven-jar-plugin.version}</version>
<executions> <executions>
<execution> <execution>
<id>create-jar</id> <id>create-jar</id>
@ -148,7 +143,7 @@
<plugin> <plugin>
<groupId>org.apache.maven.plugins</groupId> <groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-war-plugin</artifactId> <artifactId>maven-war-plugin</artifactId>
<version>2.4</version> <version>${maven-war-plugin.version}</version>
<configuration> <configuration>
<!-- archiving the classes breaks the admin screen loads in course.java <!-- archiving the classes breaks the admin screen loads in course.java
the legacy lesson loader does not look in jar files for lessons --> the legacy lesson loader does not look in jar files for lessons -->
@ -168,7 +163,7 @@
<plugin> <plugin>
<groupId>org.codehaus.mojo</groupId> <groupId>org.codehaus.mojo</groupId>
<artifactId>build-helper-maven-plugin</artifactId> <artifactId>build-helper-maven-plugin</artifactId>
<version>1.7</version> <version>${build-helper-maven-plugin.version}</version>
<executions> <executions>
<execution> <execution>
<id>attach-artifacts</id> <id>attach-artifacts</id>
@ -189,10 +184,10 @@
<plugin> <plugin>
<groupId>org.apache.tomcat.maven</groupId> <groupId>org.apache.tomcat.maven</groupId>
<artifactId>tomcat7-maven-plugin</artifactId> <artifactId>tomcat7-maven-plugin</artifactId>
<version>2.2</version> <version>${tomcat7-maven-plugin.version}</version>
<configuration> <configuration>
<server>local_tomcat</server> <server>local_tomcat</server>
<url>http://localhost:8080/manager</url> <url>http://localhost:8080/manager</url>
<path>/WebGoat</path> <path>/WebGoat</path>
<attachArtifactClassifier>exec</attachArtifactClassifier> <attachArtifactClassifier>exec</attachArtifactClassifier>
<contextReloadable>true</contextReloadable> <contextReloadable>true</contextReloadable>
@ -233,7 +228,7 @@
<plugin> <plugin>
<groupId>org.apache.maven.plugins</groupId> <groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId> <artifactId>maven-surefire-plugin</artifactId>
<version>2.18.1</version> <version>${maven-surefire-plugin.version}</version>
<configuration> <configuration>
<excludes> <excludes>
<exclude>**/*IT.java</exclude> <exclude>**/*IT.java</exclude>
@ -252,52 +247,52 @@
<dependency> <dependency>
<groupId>javax.activation</groupId> <groupId>javax.activation</groupId>
<artifactId>activation</artifactId> <artifactId>activation</artifactId>
<version>1.1</version> <version>${activation.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>com.h2database</groupId> <groupId>com.h2database</groupId>
<artifactId>h2</artifactId> <artifactId>h2</artifactId>
<version>1.4.187</version> <version>${h2.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>axis</groupId> <groupId>axis</groupId>
<artifactId>axis</artifactId> <artifactId>axis</artifactId>
<version>1.2</version> <version>${axis.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>axis</groupId> <groupId>axis</groupId>
<artifactId>axis-saaj</artifactId> <artifactId>axis-saaj</artifactId>
<version>1.2</version> <version>${axis-saaj.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>axis</groupId> <groupId>axis</groupId>
<artifactId>axis-jaxrpc</artifactId> <artifactId>axis-jaxrpc</artifactId>
<version>1.2</version> <version>${axis-jaxrpc.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>axis</groupId> <groupId>axis</groupId>
<artifactId>axis-ant</artifactId> <artifactId>axis-ant</artifactId>
<version>1.2</version> <version>${axis-ant.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.commons</groupId> <groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId> <artifactId>commons-lang3</artifactId>
<version>3.3.2</version> <version>${commons-lang3.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>commons-io</groupId> <groupId>commons-io</groupId>
<artifactId>commons-io</artifactId> <artifactId>commons-io</artifactId>
<version>1.4</version> <version>${commons-io.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>commons-collections</groupId> <groupId>commons-collections</groupId>
<artifactId>commons-collections</artifactId> <artifactId>commons-collections</artifactId>
<version>3.1</version> <version>${commons-collections.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>commons-digester</groupId> <groupId>commons-digester</groupId>
<artifactId>commons-digester</artifactId> <artifactId>commons-digester</artifactId>
<version>1.8.1</version> <version>${commons-digester.version}</version>
<exclusions> <exclusions>
<exclusion> <exclusion>
<groupId>xml-apis</groupId> <groupId>xml-apis</groupId>
@ -308,62 +303,62 @@
<dependency> <dependency>
<groupId>commons-logging</groupId> <groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId> <artifactId>commons-logging</artifactId>
<version>1.1.3</version> <version>${commons-logging.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.slf4j</groupId> <groupId>org.slf4j</groupId>
<artifactId>jcl-over-slf4j</artifactId> <artifactId>jcl-over-slf4j</artifactId>
<version>1.7.7</version> <version>${jcl-over-slf4j.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>commons-discovery</groupId> <groupId>commons-discovery</groupId>
<artifactId>commons-discovery</artifactId> <artifactId>commons-discovery</artifactId>
<version>0.2</version> <version>${commons-discovery.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>javax.mail</groupId> <groupId>javax.mail</groupId>
<artifactId>mail</artifactId> <artifactId>mail</artifactId>
<version>1.4.2</version> <version>${mail.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>javax.mail</groupId> <groupId>javax.mail</groupId>
<artifactId>mailapi</artifactId> <artifactId>mailapi</artifactId>
<version>1.4.2</version> <version>${mail.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>hsqldb</groupId> <groupId>hsqldb</groupId>
<artifactId>hsqldb</artifactId> <artifactId>hsqldb</artifactId>
<version>1.8.0.10</version> <version>${hsqldb.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>wsdl4j</groupId> <groupId>wsdl4j</groupId>
<artifactId>wsdl4j</artifactId> <artifactId>wsdl4j</artifactId>
<version>1.5.1</version> <version>${wsdl4j.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>java2html</groupId> <groupId>java2html</groupId>
<artifactId>j2h</artifactId> <artifactId>j2h</artifactId>
<version>1.3.1</version> <version>${j2h.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>ecs</groupId> <groupId>ecs</groupId>
<artifactId>ecs</artifactId> <artifactId>ecs</artifactId>
<version>1.4.2</version> <version>${ecs.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>javax.transaction</groupId> <groupId>javax.transaction</groupId>
<artifactId>javax.transaction-api</artifactId> <artifactId>javax.transaction-api</artifactId>
<version>1.2</version> <version>${javax.transaction-api.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>net.sourceforge.jtds</groupId> <groupId>net.sourceforge.jtds</groupId>
<artifactId>jtds</artifactId> <artifactId>jtds</artifactId>
<version>1.2.2</version> <version>${jtds.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.tomcat</groupId> <groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-catalina</artifactId> <artifactId>tomcat-catalina</artifactId>
<version>7.0.63</version> <version>${tomcat-catalina.version}</version>
<scope>provided</scope> <scope>provided</scope>
</dependency> </dependency>
@ -374,7 +369,7 @@
<dependency> <dependency>
<groupId>javax</groupId> <groupId>javax</groupId>
<artifactId>javaee-api</artifactId> <artifactId>javaee-api</artifactId>
<version>6.0</version> <version>${javaee-api.version}</version>
<scope>provided</scope> <scope>provided</scope>
</dependency> </dependency>
@ -388,12 +383,12 @@
<dependency> <dependency>
<groupId>com.fasterxml.jackson.core</groupId> <groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId> <artifactId>jackson-core</artifactId>
<version>2.0.4</version> <version>${jackson-core.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>com.fasterxml.jackson.core</groupId> <groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId> <artifactId>jackson-databind</artifactId>
<version>2.0.4</version> <version>${jackson-databind.version}</version>
</dependency> </dependency>
<!-- Spring MVC framework --> <!-- Spring MVC framework -->
@ -426,32 +421,32 @@
<dependency> <dependency>
<groupId>commons-fileupload</groupId> <groupId>commons-fileupload</groupId>
<artifactId>commons-fileupload</artifactId> <artifactId>commons-fileupload</artifactId>
<version>1.2.2</version> <version>${commons-fileupload.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>com.google.guava</groupId> <groupId>com.google.guava</groupId>
<artifactId>guava</artifactId> <artifactId>guava</artifactId>
<version>18.0</version> <version>${guava.version}</version>
</dependency> </dependency>
<!-- JSTL --> <!-- JSTL -->
<dependency> <dependency>
<groupId>javax.servlet</groupId> <groupId>javax.servlet</groupId>
<artifactId>jstl</artifactId> <artifactId>jstl</artifactId>
<version>1.2</version> <version>${jstl.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>taglibs</groupId> <groupId>taglibs</groupId>
<artifactId>standard</artifactId> <artifactId>standard</artifactId>
<version>1.1.2</version> <version>${standard.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>log4j</groupId> <groupId>log4j</groupId>
<artifactId>log4j</artifactId> <artifactId>log4j</artifactId>
<version>1.2.17</version> <version>${log4j.version}</version>
<exclusions> <exclusions>
<exclusion> <exclusion>
<groupId>javax.jms</groupId> <groupId>javax.jms</groupId>
@ -476,13 +471,13 @@
<dependency> <dependency>
<groupId>org.slf4j</groupId> <groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId> <artifactId>slf4j-api</artifactId>
<version>1.7.7</version> <version>${slf4j-api.version}</version>
<type>jar</type> <type>jar</type>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.slf4j</groupId> <groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId> <artifactId>slf4j-log4j12</artifactId>
<version>1.7.7</version> <version>${slf4j-log4j12.version}</version>
<type>jar</type> <type>jar</type>
</dependency> </dependency>
<!-- ************* END spring MVC and related dependencies ************** --> <!-- ************* END spring MVC and related dependencies ************** -->
@ -490,21 +485,22 @@
<dependency> <dependency>
<groupId>junit</groupId> <groupId>junit</groupId>
<artifactId>junit</artifactId> <artifactId>junit</artifactId>
<version>4.12</version> <version>${junit.version}</version>
<type>jar</type> <type>jar</type>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.seleniumhq.selenium</groupId> <groupId>org.seleniumhq.selenium</groupId>
<artifactId>selenium-java</artifactId> <artifactId>selenium-java</artifactId>
<version>2.47.1</version> <version>${selenium-java.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>com.saucelabs</groupId> <groupId>com.saucelabs</groupId>
<artifactId>sauce_junit</artifactId> <artifactId>sauce_junit</artifactId>
<version>2.1.18</version> <version>${sauce_junit.version}</version>
<scope>test</scope> <scope>test</scope>
</dependency> </dependency>
<!-- ************* END: Dependencies for Unit and Integration Testing ************** --> <!-- ************* END: Dependencies for Unit and Integration Testing ************** -->
<!-- ************* END: <dependencies> ************** --> <!-- ************* END: <dependencies> ************** -->
</dependencies> </dependencies>
</project> </project>

16
webgoat-container/src/main/java/org/owasp/webgoat/Catcher.java
View File

@ -11,7 +11,8 @@ import org.owasp.webgoat.session.Course;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -39,7 +40,8 @@ import org.owasp.webgoat.session.WebSession;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created March 13, 2007 * @since March 13, 2007
* @version $Id: $Id
*/ */
public class Catcher extends HammerHead public class Catcher extends HammerHead
{ {
@ -54,19 +56,19 @@ public class Catcher extends HammerHead
*/ */
public final static String START_SOURCE_SKIP = "START_OMIT_SOURCE"; public final static String START_SOURCE_SKIP = "START_OMIT_SOURCE";
/** Constant <code>END_SOURCE_SKIP="END_OMIT_SOURCE"</code> */
public final static String END_SOURCE_SKIP = "END_OMIT_SOURCE"; public final static String END_SOURCE_SKIP = "END_OMIT_SOURCE";
/** Constant <code>PROPERTY="PROPERTY"</code> */
public static final String PROPERTY = "PROPERTY"; public static final String PROPERTY = "PROPERTY";
/** Constant <code>EMPTY_STRING=""</code> */
public static final String EMPTY_STRING = ""; public static final String EMPTY_STRING = "";
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param request * Description of the Method
* Description of the Parameter
* @param response
* Description of the Parameter
* @exception IOException * @exception IOException
* Description of the Exception * Description of the Exception
* @exception ServletException * @exception ServletException

27
webgoat-container/src/main/java/org/owasp/webgoat/HammerHead.java
View File

@ -55,11 +55,11 @@ import java.util.TimeZone;
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
*
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect
* Security</a> * Security</a>
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class HammerHead extends HttpServlet { public class HammerHead extends HttpServlet {
@ -95,10 +95,9 @@ public class HammerHead extends HttpServlet {
private WebgoatContext webgoatContext = null; private WebgoatContext webgoatContext = null;
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param request Description of the Parameter * Description of the Method
* @param response Description of the Parameter
* @exception IOException Description of the Exception * @exception IOException Description of the Exception
* @exception ServletException Description of the Exception * @exception ServletException Description of the Exception
*/ */
@ -108,10 +107,9 @@ public class HammerHead extends HttpServlet {
} }
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param request Description of the Parameter * Description of the Method
* @param response Description of the Parameter
* @exception IOException Description of the Exception * @exception IOException Description of the Exception
* @exception ServletException Description of the Exception * @exception ServletException Description of the Exception
*/ */
@ -227,9 +225,9 @@ public class HammerHead extends HttpServlet {
} }
/** /**
* Return information about this servlet * {@inheritDoc}
* *
* @return The servletInfo value * Return information about this servlet
*/ */
@Override @Override
public String getServletInfo() { public String getServletInfo() {
@ -237,9 +235,9 @@ public class HammerHead extends HttpServlet {
} }
/** /**
* Return properties path * {@inheritDoc}
* *
* @throws javax.servlet.ServletException * Return properties path
*/ */
@Override @Override
public void init() throws ServletException { public void init() throws ServletException {
@ -371,7 +369,7 @@ public class HammerHead extends HttpServlet {
* @param response Description of the Parameter * @param response Description of the Parameter
* @param context Description of the Parameter * @param context Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
* @throws java.io.IOException * @throws java.io.IOException if any.
*/ */
protected WebSession updateSession(HttpServletRequest request, HttpServletResponse response, ServletContext context) protected WebSession updateSession(HttpServletRequest request, HttpServletResponse response, ServletContext context)
throws IOException { throws IOException {
@ -415,9 +413,10 @@ public class HammerHead extends HttpServlet {
* Description of the Method * Description of the Method
* *
* @param s Description of the Parameter * @param s Description of the Parameter
* @param screen * @param screen a {@link org.owasp.webgoat.session.Screen} object.
* @param response Description of the Parameter * @param response Description of the Parameter
* @exception IOException Description of the Exception * @exception IOException Description of the Exception
* @throws java.io.IOException if any.
*/ */
protected void writeScreen(WebSession s, Screen screen, HttpServletResponse response) throws IOException { protected void writeScreen(WebSession s, Screen screen, HttpServletResponse response) throws IOException {
response.setContentType("text/html"); response.setContentType("text/html");

16
webgoat-container/src/main/java/org/owasp/webgoat/LessonSource.java
View File

@ -40,7 +40,8 @@ import org.owasp.webgoat.session.WebSession;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class LessonSource extends HammerHead { public class LessonSource extends HammerHead {
@ -54,13 +55,13 @@ public class LessonSource extends HammerHead {
*/ */
public final static String START_SOURCE_SKIP = "START_OMIT_SOURCE"; public final static String START_SOURCE_SKIP = "START_OMIT_SOURCE";
/** Constant <code>END_SOURCE_SKIP="END_OMIT_SOURCE"</code> */
public final static String END_SOURCE_SKIP = "END_OMIT_SOURCE"; public final static String END_SOURCE_SKIP = "END_OMIT_SOURCE";
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param request Description of the Parameter * Description of the Method
* @param response Description of the Parameter
* @exception IOException Description of the Exception * @exception IOException Description of the Exception
* @exception ServletException Description of the Exception * @exception ServletException Description of the Exception
*/ */
@ -142,6 +143,12 @@ public class LessonSource extends HammerHead {
"Code Section Deliberately Omitted")); "Code Section Deliberately Omitted"));
} }
/**
* <p>getSolution.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.lang.String} object.
*/
protected String getSolution(WebSession s) { protected String getSolution(WebSession s) {
String source = null; String source = null;
@ -169,6 +176,7 @@ public class LessonSource extends HammerHead {
* @param s Description of the Parameter * @param s Description of the Parameter
* @param response Description of the Parameter * @param response Description of the Parameter
* @exception IOException Description of the Exception * @exception IOException Description of the Exception
* @throws java.io.IOException if any.
*/ */
protected void writeSource(String s, HttpServletResponse response) throws IOException { protected void writeSource(String s, HttpServletResponse response) throws IOException {
response.setContentType("text/html"); response.setContentType("text/html");

19
webgoat-container/src/main/java/org/owasp/webgoat/application/Application.java
View File

@ -12,6 +12,7 @@ import org.apache.commons.lang3.builder.ToStringBuilder;
* Singleton which is created on context startup * Singleton which is created on context startup
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
public class Application { public class Application {
@ -21,6 +22,11 @@ public class Application {
} }
/**
* <p>getInstance.</p>
*
* @return a {@link org.owasp.webgoat.application.Application} object.
*/
public static final Application getInstance() { public static final Application getInstance() {
return INSTANCE; return INSTANCE;
} }
@ -30,6 +36,8 @@ public class Application {
private String name = "WebGoat"; private String name = "WebGoat";
/** /**
* <p>Getter for the field <code>version</code>.</p>
*
* @return the version * @return the version
*/ */
public String getVersion() { public String getVersion() {
@ -37,6 +45,8 @@ public class Application {
} }
/** /**
* <p>Setter for the field <code>version</code>.</p>
*
* @param version the version to set * @param version the version to set
*/ */
public void setVersion(String version) { public void setVersion(String version) {
@ -46,6 +56,8 @@ public class Application {
} }
/** /**
* <p>Getter for the field <code>build</code>.</p>
*
* @return the build * @return the build
*/ */
public String getBuild() { public String getBuild() {
@ -53,6 +65,8 @@ public class Application {
} }
/** /**
* <p>Setter for the field <code>build</code>.</p>
*
* @param build the build to set * @param build the build to set
*/ */
public void setBuild(String build) { public void setBuild(String build) {
@ -62,6 +76,8 @@ public class Application {
} }
/** /**
* <p>Getter for the field <code>name</code>.</p>
*
* @return the name * @return the name
*/ */
public String getName() { public String getName() {
@ -69,6 +85,8 @@ public class Application {
} }
/** /**
* <p>Setter for the field <code>name</code>.</p>
*
* @param name the name to set * @param name the name to set
*/ */
public void setName(String name) { public void setName(String name) {
@ -77,6 +95,7 @@ public class Application {
} }
} }
/** {@inheritDoc} */
@Override @Override
public String toString() { public String toString() {
return new ToStringBuilder(this). return new ToStringBuilder(this).

3
webgoat-container/src/main/java/org/owasp/webgoat/application/WebGoatServletListener.java
View File

@ -17,9 +17,11 @@ import java.util.jar.Manifest;
* Web application lifecycle listener. * Web application lifecycle listener.
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
public class WebGoatServletListener implements ServletContextListener { public class WebGoatServletListener implements ServletContextListener {
/** {@inheritDoc} */
@Override @Override
public void contextInitialized(ServletContextEvent sce) { public void contextInitialized(ServletContextEvent sce) {
ServletContext context = sce.getServletContext(); ServletContext context = sce.getServletContext();
@ -27,6 +29,7 @@ public class WebGoatServletListener implements ServletContextListener {
setApplicationVariables(context); setApplicationVariables(context);
} }
/** {@inheritDoc} */
@Override @Override
public void contextDestroyed(ServletContextEvent sce) { public void contextDestroyed(ServletContextEvent sce) {
ServletContext context = sce.getServletContext(); ServletContext context = sce.getServletContext();

10
webgoat-container/src/main/java/org/owasp/webgoat/controller/About.java
View File

@ -16,8 +16,10 @@ import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.servlet.ModelAndView; import org.springframework.web.servlet.ModelAndView;
/** /**
* <p>About class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class About { public class About {
@ -25,6 +27,14 @@ public class About {
final Logger logger = LoggerFactory.getLogger(About.class); final Logger logger = LoggerFactory.getLogger(About.class);
private static final String WELCOMED = "welcomed"; private static final String WELCOMED = "welcomed";
/**
* <p>welcome.</p>
*
* @param request a {@link javax.servlet.http.HttpServletRequest} object.
* @param error a {@link java.lang.String} object.
* @param logout a {@link java.lang.String} object.
* @return a {@link org.springframework.web.servlet.ModelAndView} object.
*/
@RequestMapping(value = "about.mvc", method = RequestMethod.GET) @RequestMapping(value = "about.mvc", method = RequestMethod.GET)
public ModelAndView welcome(HttpServletRequest request, public ModelAndView welcome(HttpServletRequest request,
@RequestParam(value = "error", required = false) String error, @RequestParam(value = "error", required = false) String error,

9
webgoat-container/src/main/java/org/owasp/webgoat/controller/Login.java
View File

@ -12,12 +12,21 @@ import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.servlet.ModelAndView; import org.springframework.web.servlet.ModelAndView;
/** /**
* <p>Login class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class Login { public class Login {
/**
* <p>login.</p>
*
* @param error a {@link java.lang.String} object.
* @param logout a {@link java.lang.String} object.
* @return a {@link org.springframework.web.servlet.ModelAndView} object.
*/
@RequestMapping(value = "login.mvc", method = RequestMethod.GET) @RequestMapping(value = "login.mvc", method = RequestMethod.GET)
public ModelAndView login( public ModelAndView login(
@RequestParam(value = "error", required = false) String error, @RequestParam(value = "error", required = false) String error,

9
webgoat-container/src/main/java/org/owasp/webgoat/controller/Logout.java
View File

@ -14,14 +14,23 @@ import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.servlet.ModelAndView; import org.springframework.web.servlet.ModelAndView;
/** /**
* <p>Logout class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class Logout { public class Logout {
final Logger logger = LoggerFactory.getLogger(Logout.class); final Logger logger = LoggerFactory.getLogger(Logout.class);
/**
* <p>logout.</p>
*
* @param error a {@link java.lang.String} object.
* @param logout a {@link java.lang.String} object.
* @return a {@link org.springframework.web.servlet.ModelAndView} object.
*/
@RequestMapping(value = "logout.mvc", method = RequestMethod.GET) @RequestMapping(value = "logout.mvc", method = RequestMethod.GET)
public ModelAndView logout( public ModelAndView logout(
@RequestParam(value = "error", required = false) String error, @RequestParam(value = "error", required = false) String error,

16
webgoat-container/src/main/java/org/owasp/webgoat/controller/Start.java
View File

@ -24,8 +24,10 @@ import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.servlet.ModelAndView; import org.springframework.web.servlet.ModelAndView;
/** /**
* <p>Start class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class Start { public class Start {
@ -37,6 +39,14 @@ public class Start {
@Autowired @Autowired
private ServletContext servletContext; private ServletContext servletContext;
/**
* <p>start.</p>
*
* @param request a {@link javax.servlet.http.HttpServletRequest} object.
* @param error a {@link java.lang.String} object.
* @param logout a {@link java.lang.String} object.
* @return a {@link org.springframework.web.servlet.ModelAndView} object.
*/
@RequestMapping(value = "start.mvc", method = {RequestMethod.GET, RequestMethod.POST}) @RequestMapping(value = "start.mvc", method = {RequestMethod.GET, RequestMethod.POST})
public ModelAndView start(HttpServletRequest request, public ModelAndView start(HttpServletRequest request,
@RequestParam(value = "error", required = false) String error, @RequestParam(value = "error", required = false) String error,
@ -82,6 +92,12 @@ public class Start {
return role; return role;
} }
/**
* <p>checkWebSession.</p>
*
* @param session a {@link javax.servlet.http.HttpSession} object.
* @return a boolean.
*/
public boolean checkWebSession(HttpSession session) { public boolean checkWebSession(HttpSession session) {
Object o = session.getAttribute(WebSession.SESSION); Object o = session.getAttribute(WebSession.SESSION);
if (o == null) { if (o == null) {

10
webgoat-container/src/main/java/org/owasp/webgoat/controller/Welcome.java
View File

@ -16,8 +16,10 @@ import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.servlet.ModelAndView; import org.springframework.web.servlet.ModelAndView;
/** /**
* <p>Welcome class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class Welcome { public class Welcome {
@ -25,6 +27,14 @@ public class Welcome {
final Logger logger = LoggerFactory.getLogger(Welcome.class); final Logger logger = LoggerFactory.getLogger(Welcome.class);
private static final String WELCOMED = "welcomed"; private static final String WELCOMED = "welcomed";
/**
* <p>welcome.</p>
*
* @param request a {@link javax.servlet.http.HttpServletRequest} object.
* @param error a {@link java.lang.String} object.
* @param logout a {@link java.lang.String} object.
* @return a {@link org.springframework.web.servlet.ModelAndView} object.
*/
@RequestMapping(value = "welcome.mvc", method = RequestMethod.GET) @RequestMapping(value = "welcome.mvc", method = RequestMethod.GET)
public ModelAndView welcome(HttpServletRequest request, public ModelAndView welcome(HttpServletRequest request,
@RequestParam(value = "error", required = false) String error, @RequestParam(value = "error", required = false) String error,

293
webgoat-container/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java
View File

@ -37,37 +37,36 @@ import java.util.List;
import java.util.Map; import java.util.Map;
/** /**
* ************************************************************************************************* *************************************************************************************************
* <p> *
* <p> *
* This file is part of WebGoat, an Open Web Application Security Project * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
* utility. For details, please see http://www.owasp.org/ * please see http://www.owasp.org/
* <p> *
* Copyright (c) 2002 - 20014 Bruce Mayhew * Copyright (c) 2002 - 20014 Bruce Mayhew
* <p> *
* This program is free software; you can redistribute it and/or modify it under * This program is free software; you can redistribute it and/or modify it under the terms of the
* the terms of the GNU General Public License as published by the Free Software * GNU General Public License as published by the Free Software Foundation; either version 2 of the
* Foundation; either version 2 of the License, or (at your option) any later * License, or (at your option) any later version.
* version. *
* <p> * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* This program is distributed in the hope that it will be useful, but WITHOUT * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS * General Public License for more details.
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more *
* details. * You should have received a copy of the GNU General Public License along with this program; if
* <p> * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
* You should have received a copy of the GNU General Public License along with * 02111-1307, USA.
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple *
* Place - Suite 330, Boston, MA 02111-1307, USA.
* <p>
* Getting Source ============== * Getting Source ==============
* <p> *
* Source for this application is maintained at * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
* https://github.com/WebGoat/WebGoat, a repository for free software projects. * projects.
* <p> *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public abstract class AbstractLesson extends Screen implements Comparable<Object> { public abstract class AbstractLesson extends Screen implements Comparable<Object> {
@ -78,6 +77,7 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
*/ */
public final static String ADMIN_ROLE = "admin"; public final static String ADMIN_ROLE = "admin";
/** Constant <code>CHALLENGE_ROLE="challenge"</code> */
public final static String CHALLENGE_ROLE = "challenge"; public final static String CHALLENGE_ROLE = "challenge";
/** /**
@ -126,19 +126,39 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
id = new Integer(++count); id = new Integer(++count);
} }
/**
* <p>getName.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getName() { public String getName() {
String className = getClass().getName(); String className = getClass().getName();
return className.substring(className.lastIndexOf('.') + 1); return className.substring(className.lastIndexOf('.') + 1);
} }
/**
* <p>Setter for the field <code>ranking</code>.</p>
*
* @param ranking a {@link java.lang.Integer} object.
*/
public void setRanking(Integer ranking) { public void setRanking(Integer ranking) {
this.ranking = ranking; this.ranking = ranking;
} }
/**
* <p>Setter for the field <code>hidden</code>.</p>
*
* @param hidden a boolean.
*/
public void setHidden(boolean hidden) { public void setHidden(boolean hidden) {
this.hidden = hidden; this.hidden = hidden;
} }
/**
* <p>update.</p>
*
* @param properties a {@link org.owasp.webgoat.session.WebgoatProperties} object.
*/
public void update(WebgoatProperties properties) { public void update(WebgoatProperties properties) {
String className = getClass().getName(); String className = getClass().getName();
className = className.substring(className.lastIndexOf(".") + 1); className = className.substring(className.lastIndexOf(".") + 1);
@ -156,6 +176,12 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
// " + getRanking() + ", hidden:" + hidden +")"); // " + getRanking() + ", hidden:" + hidden +")");
} }
/**
* <p>isCompleted.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a boolean.
*/
public boolean isCompleted(WebSession s) { public boolean isCompleted(WebSession s) {
return getLessonTracker(s, this).getCompleted(); return getLessonTracker(s, this).getCompleted();
} }
@ -169,20 +195,18 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
public abstract Element getCredits(); public abstract Element getCredits();
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param obj Description of the Parameter * Description of the Method
* @return Description of the Return Value
*/ */
public int compareTo(Object obj) { public int compareTo(Object obj) {
return this.getRanking().compareTo(((AbstractLesson) obj).getRanking()); return this.getRanking().compareTo(((AbstractLesson) obj).getRanking());
} }
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param obj Description of the Parameter * Description of the Method
* @return Description of the Return Value
*/ */
public boolean equals(Object obj) { public boolean equals(Object obj) {
return this.getScreenId() == ((AbstractLesson) obj).getScreenId(); return this.getScreenId() == ((AbstractLesson) obj).getScreenId();
@ -197,10 +221,25 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
return category; return category;
} }
/**
* <p>getDefaultRanking.</p>
*
* @return a {@link java.lang.Integer} object.
*/
protected abstract Integer getDefaultRanking(); protected abstract Integer getDefaultRanking();
/**
* <p>getDefaultCategory.</p>
*
* @return a {@link org.owasp.webgoat.lessons.Category} object.
*/
protected abstract Category getDefaultCategory(); protected abstract Category getDefaultCategory();
/**
* <p>getDefaultHidden.</p>
*
* @return a boolean.
*/
protected abstract boolean getDefaultHidden(); protected abstract boolean getDefaultHidden();
/** /**
@ -322,10 +361,22 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
return getHints(s).size(); return getHints(s).size();
} }
/**
* <p>getHints.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.util.List} object.
*/
protected abstract List<String> getHints(WebSession s); protected abstract List<String> getHints(WebSession s);
// @TODO we need to restrict access at the service layer // @TODO we need to restrict access at the service layer
// rather than passing session object around // rather than passing session object around
/**
* <p>getHintsPublic.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.util.List} object.
*/
public List<String> getHintsPublic(WebSession s) { public List<String> getHintsPublic(WebSession s) {
List<String> hints = getHints(s); List<String> hints = getHints(s);
return hints; return hints;
@ -337,6 +388,7 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
* *
* @param s The users WebSession * @param s The users WebSession
* @return The hint1 value * @return The hint1 value
* @param hintNumber a int.
*/ */
public String getHint(WebSession s, int hintNumber) { public String getHint(WebSession s, int hintNumber) {
return "Hint: " + getHints(s).get(hintNumber); return "Hint: " + getHints(s).get(hintNumber);
@ -346,6 +398,7 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
* Gets the instructions attribute of the AbstractLesson object * Gets the instructions attribute of the AbstractLesson object
* *
* @return The instructions value * @return The instructions value
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
*/ */
public abstract String getInstructions(WebSession s); public abstract String getInstructions(WebSession s);
@ -444,6 +497,12 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
return id.intValue(); return id.intValue();
} }
/**
* <p>getHtml_DELETE_ME.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.lang.String} object.
*/
public String getHtml_DELETE_ME(WebSession s) { public String getHtml_DELETE_ME(WebSession s) {
String html = null; String html = null;
@ -459,6 +518,12 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
return html; return html;
} }
/**
* <p>getSource.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.lang.String} object.
*/
public String getSource(WebSession s) { public String getSource(WebSession s) {
String source = null; String source = null;
String src = null; String src = null;
@ -498,6 +563,12 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
return source; return source;
} }
/**
* <p>getRawSource.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.lang.String} object.
*/
public String getRawSource(WebSession s) { public String getRawSource(WebSession s) {
String src; String src;
@ -517,6 +588,12 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
return src; return src;
} }
/**
* <p>getSolution.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.lang.String} object.
*/
public String getSolution(WebSession s) { public String getSolution(WebSession s) {
String src = null; String src = null;
@ -538,17 +615,17 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
} }
/** /**
* <p> * <p>Returns the default "path" portion of a lesson's URL.</p>
* Returns the default "path" portion of a lesson's URL.</p> *
* <p> *
* <p>
* Legacy webgoat lesson links are of the form * Legacy webgoat lesson links are of the form
* "attack?Screen=Xmenu=Ystage=Z". This method returns the path portion of * "attack?Screen=Xmenu=Ystage=Z". This method returns the path portion of
* the url, i.e., "attack" in the string above.</p> * the url, i.e., "attack" in the string above.
* <p> *
* <p>
* Newer, Spring-Controller-based classes will override this method to * Newer, Spring-Controller-based classes will override this method to
* return "*.do"-styled paths.</p> * return "*.do"-styled paths.
*
* @return a {@link java.lang.String} object.
*/ */
protected String getPath() { protected String getPath() {
return "#attack"; return "#attack";
@ -557,7 +634,7 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
/** /**
* Get the link that can be used to request this screen. * Get the link that can be used to request this screen.
* *
* @return * @return a {@link java.lang.String} object.
*/ */
public String getLink() { public String getLink() {
StringBuffer link = new StringBuffer(); StringBuffer link = new StringBuffer();
@ -574,7 +651,8 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
/** /**
* Get the link to the jsp page used to render this screen. * Get the link to the jsp page used to render this screen.
* *
* @return * @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.lang.String} object.
*/ */
public String getPage(WebSession s) { public String getPage(WebSession s) {
return null; return null;
@ -583,22 +661,36 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
/** /**
* Get the link to the jsp template page used to render this screen. * Get the link to the jsp template page used to render this screen.
* *
* @return * @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.lang.String} object.
*/ */
public String getTemplatePage(WebSession s) { public String getTemplatePage(WebSession s) {
return null; return null;
} }
/**
* <p>getCurrentAction.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.lang.String} object.
*/
public abstract String getCurrentAction(WebSession s); public abstract String getCurrentAction(WebSession s);
/**
* <p>setCurrentAction.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param lessonScreen a {@link java.lang.String} object.
*/
public abstract void setCurrentAction(WebSession s, String lessonScreen); public abstract void setCurrentAction(WebSession s, String lessonScreen);
/** /**
* Override this method to implement accesss control in a lesson. * Override this method to implement accesss control in a lesson.
* *
* @param s * @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param functionId * @param functionId a {@link java.lang.String} object.
* @return * @param employeeId a int.
* @return a boolean.
*/ */
public boolean isAuthorized(WebSession s, int employeeId, String functionId) { public boolean isAuthorized(WebSession s, int employeeId, String functionId) {
return false; return false;
@ -607,9 +699,10 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
/** /**
* Override this method to implement accesss control in a lesson. * Override this method to implement accesss control in a lesson.
* *
* @param s * @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param functionId * @param functionId a {@link java.lang.String} object.
* @return * @param role a {@link java.lang.String} object.
* @return a boolean.
*/ */
public boolean isAuthorized(WebSession s, String role, String functionId) { public boolean isAuthorized(WebSession s, String role, String functionId) {
logger.info("Checking if " + role + " authorized for: " + functionId); logger.info("Checking if " + role + " authorized for: " + functionId);
@ -633,10 +726,24 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
return authorized; return authorized;
} }
/**
* <p>getUserId.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a int.
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
*/
public int getUserId(WebSession s) throws ParameterNotFoundException { public int getUserId(WebSession s) throws ParameterNotFoundException {
return -1; return -1;
} }
/**
* <p>getUserName.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
*/
public String getUserName(WebSession s) throws ParameterNotFoundException { public String getUserName(WebSession s) throws ParameterNotFoundException {
return null; return null;
} }
@ -739,6 +846,11 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
s.getRequest().getRequestURL(); s.getRequest().getRequestURL();
} }
/**
* <p>getFormAction.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getFormAction() { public String getFormAction() {
return getLink(); return getLink();
} }
@ -746,17 +858,27 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
/** /**
* Description of the Method * Description of the Method
* *
* @param s Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public String toString() { public String toString() {
return getTitle(); return getTitle();
} }
/**
* <p>Getter for the field <code>defaultLanguage</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getDefaultLanguage() { public String getDefaultLanguage() {
return this.defaultLanguage; return this.defaultLanguage;
} }
/**
* <p>Getter for the field <code>lessonPlanFileName</code>.</p>
*
* @param lang a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
*/
public String getLessonPlanFileName(String lang) { public String getLessonPlanFileName(String lang) {
String ret = lessonPlanFileName.get(lang); String ret = lessonPlanFileName.get(lang);
if (ret == null) { if (ret == null) {
@ -765,40 +887,86 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
return ret; return ret;
} }
/**
* <p>Setter for the field <code>lessonPlanFileName</code>.</p>
*
* @param lang a {@link java.lang.String} object.
* @param lessonPlanFileName a {@link java.lang.String} object.
*/
public void setLessonPlanFileName(String lang, String lessonPlanFileName) { public void setLessonPlanFileName(String lang, String lessonPlanFileName) {
this.lessonPlanFileName.put(lang, lessonPlanFileName); this.lessonPlanFileName.put(lang, lessonPlanFileName);
this.availableLanguages.add(lang); this.availableLanguages.add(lang);
} }
/**
* <p>Getter for the field <code>availableLanguages</code>.</p>
*
* @return a {@link java.util.List} object.
*/
public List<String> getAvailableLanguages() { public List<String> getAvailableLanguages() {
return this.availableLanguages; return this.availableLanguages;
} }
/**
* <p>Getter for the field <code>lessonSolutionFileName</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getLessonSolutionFileName() { public String getLessonSolutionFileName() {
return lessonSolutionFileName; return lessonSolutionFileName;
} }
/**
* <p>Setter for the field <code>lessonSolutionFileName</code>.</p>
*
* @param lessonSolutionFileName a {@link java.lang.String} object.
*/
public void setLessonSolutionFileName(String lessonSolutionFileName) { public void setLessonSolutionFileName(String lessonSolutionFileName) {
this.lessonSolutionFileName = lessonSolutionFileName; this.lessonSolutionFileName = lessonSolutionFileName;
} }
/**
* <p>Getter for the field <code>sourceFileName</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getSourceFileName() { public String getSourceFileName() {
return sourceFileName; return sourceFileName;
} }
/**
* <p>Setter for the field <code>sourceFileName</code>.</p>
*
* @param sourceFileName a {@link java.lang.String} object.
*/
public void setSourceFileName(String sourceFileName) { public void setSourceFileName(String sourceFileName) {
logger.debug("Setting source file of lesson " + this + " to: " + sourceFileName); logger.debug("Setting source file of lesson " + this + " to: " + sourceFileName);
this.sourceFileName = sourceFileName; this.sourceFileName = sourceFileName;
} }
/**
* <p>Getter for the field <code>webgoatContext</code>.</p>
*
* @return a {@link org.owasp.webgoat.session.WebgoatContext} object.
*/
public WebgoatContext getWebgoatContext() { public WebgoatContext getWebgoatContext() {
return webgoatContext; return webgoatContext;
} }
/**
* <p>Setter for the field <code>webgoatContext</code>.</p>
*
* @param webgoatContext a {@link org.owasp.webgoat.session.WebgoatContext} object.
*/
public void setWebgoatContext(WebgoatContext webgoatContext) { public void setWebgoatContext(WebgoatContext webgoatContext) {
this.webgoatContext = webgoatContext; this.webgoatContext = webgoatContext;
} }
/**
* <p>Getter for the field <code>labelManager</code>.</p>
*
* @return a {@link org.owasp.webgoat.util.LabelManager} object.
*/
protected LabelManager getLabelManager() { protected LabelManager getLabelManager() {
if (labelManager == null) { if (labelManager == null) {
labelManager = BeanProvider.getBean("labelManager", LabelManager.class); labelManager = BeanProvider.getBean("labelManager", LabelManager.class);
@ -812,6 +980,10 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
* A reference in include directives are made from within the web application on the server. * A reference in include directives are made from within the web application on the server.
* However, img tags (and the like) make references from the client browser. * However, img tags (and the like) make references from the client browser.
* In such external references, the context path must be included. * In such external references, the context path must be included.
*
* @param w a {@link org.owasp.webgoat.session.WebSession} object.
* @param imgResourceName a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
*/ */
protected final String buildImagePath(WebSession w, String imgResourceName) { protected final String buildImagePath(WebSession w, String imgResourceName) {
return w.getRequest() return w.getRequest()
@ -819,16 +991,37 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
} }
/**
* <p>buildJspPath.</p>
*
* @param w a {@link org.owasp.webgoat.session.WebSession} object.
* @param jspResourceName a {@link java.lang.String} object.
* @param includeContextPath a boolean.
* @return a {@link java.lang.String} object.
*/
protected final String buildJspPath(WebSession w, String jspResourceName, boolean includeContextPath) { protected final String buildJspPath(WebSession w, String jspResourceName, boolean includeContextPath) {
String path = includeContextPath ? w.getContext().getContextPath() : ""; String path = includeContextPath ? w.getContext().getContextPath() : "";
return path + "/plugin_extracted/plugin/" + getLessonName() + "/jsp/" + jspResourceName; return path + "/plugin_extracted/plugin/" + getLessonName() + "/jsp/" + jspResourceName;
} }
/**
* <p>buildJsPath.</p>
*
* @param w a {@link org.owasp.webgoat.session.WebSession} object.
* @param jsResourceName a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
*/
protected final String buildJsPath(WebSession w, String jsResourceName) { protected final String buildJsPath(WebSession w, String jsResourceName) {
return w.getRequest() return w.getRequest()
.getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/js/" + jsResourceName; .getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/js/" + jsResourceName;
} }
/**
* <p>getLessonDirectory.</p>
*
* @param w a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.io.File} object.
*/
protected final File getLessonDirectory(WebSession w) { protected final File getLessonDirectory(WebSession w) {
return new File(w.getContext().getRealPath("/plugin_extracted/plugin/" + getLessonName() + "/")); return new File(w.getContext().getRealPath("/plugin_extracted/plugin/" + getLessonName() + "/"));
} }

60
webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java
View File

@ -35,50 +35,72 @@ import java.util.List;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class Category implements Comparable { public class Category implements Comparable {
/** Constant <code>INTRODUCTION</code> */
public final static Category INTRODUCTION = new Category("Introduction", new Integer(5)); public final static Category INTRODUCTION = new Category("Introduction", new Integer(5));
/** Constant <code>GENERAL</code> */
public final static Category GENERAL = new Category("General", new Integer(100)); public final static Category GENERAL = new Category("General", new Integer(100));
/** Constant <code>ACCESS_CONTROL</code> */
public final static Category ACCESS_CONTROL = new Category("Access Control Flaws", new Integer(200)); public final static Category ACCESS_CONTROL = new Category("Access Control Flaws", new Integer(200));
/** Constant <code>AJAX_SECURITY</code> */
public final static Category AJAX_SECURITY = new Category("AJAX Security", new Integer(400)); public final static Category AJAX_SECURITY = new Category("AJAX Security", new Integer(400));
/** Constant <code>AUTHENTICATION</code> */
public final static Category AUTHENTICATION = new Category("Authentication Flaws", new Integer(500)); public final static Category AUTHENTICATION = new Category("Authentication Flaws", new Integer(500));
/** Constant <code>BUFFER_OVERFLOW</code> */
public final static Category BUFFER_OVERFLOW = new Category("Buffer Overflows", new Integer(600)); public final static Category BUFFER_OVERFLOW = new Category("Buffer Overflows", new Integer(600));
/** Constant <code>CODE_QUALITY</code> */
public final static Category CODE_QUALITY = new Category("Code Quality", new Integer(700)); public final static Category CODE_QUALITY = new Category("Code Quality", new Integer(700));
/** Constant <code>CONCURRENCY</code> */
public final static Category CONCURRENCY = new Category("Concurrency", new Integer(800)); public final static Category CONCURRENCY = new Category("Concurrency", new Integer(800));
/** Constant <code>XSS</code> */
public final static Category XSS = new Category("Cross-Site Scripting (XSS)", new Integer(900)); public final static Category XSS = new Category("Cross-Site Scripting (XSS)", new Integer(900));
/** Constant <code>ERROR_HANDLING</code> */
public final static Category ERROR_HANDLING = new Category("Improper Error Handling", new Integer(1000)); public final static Category ERROR_HANDLING = new Category("Improper Error Handling", new Integer(1000));
/** Constant <code>INJECTION</code> */
public final static Category INJECTION = new Category("Injection Flaws", new Integer(1100)); public final static Category INJECTION = new Category("Injection Flaws", new Integer(1100));
/** Constant <code>DOS</code> */
public final static Category DOS = new Category("Denial of Service", new Integer(1200)); public final static Category DOS = new Category("Denial of Service", new Integer(1200));
/** Constant <code>INSECURE_COMMUNICATION</code> */
public final static Category INSECURE_COMMUNICATION = new Category("Insecure Communication", new Integer(1300)); public final static Category INSECURE_COMMUNICATION = new Category("Insecure Communication", new Integer(1300));
/** Constant <code>INSECURE_CONFIGURATION</code> */
public final static Category INSECURE_CONFIGURATION = new Category("Insecure Configuration", new Integer(1400)); public final static Category INSECURE_CONFIGURATION = new Category("Insecure Configuration", new Integer(1400));
/** Constant <code>INSECURE_STORAGE</code> */
public final static Category INSECURE_STORAGE = new Category("Insecure Storage", new Integer(1500)); public final static Category INSECURE_STORAGE = new Category("Insecure Storage", new Integer(1500));
/** Constant <code>MALICIOUS_EXECUTION</code> */
public final static Category MALICIOUS_EXECUTION = new Category("Malicious Execution", new Integer(1600)); public final static Category MALICIOUS_EXECUTION = new Category("Malicious Execution", new Integer(1600));
/** Constant <code>PARAMETER_TAMPERING</code> */
public final static Category PARAMETER_TAMPERING = new Category("Parameter Tampering", new Integer(1700)); public final static Category PARAMETER_TAMPERING = new Category("Parameter Tampering", new Integer(1700));
/** Constant <code>SESSION_MANAGEMENT</code> */
public final static Category SESSION_MANAGEMENT = new Category("Session Management Flaws", new Integer(1800)); public final static Category SESSION_MANAGEMENT = new Category("Session Management Flaws", new Integer(1800));
/** Constant <code>WEB_SERVICES</code> */
public final static Category WEB_SERVICES = new Category("Web Services", new Integer(1900)); public final static Category WEB_SERVICES = new Category("Web Services", new Integer(1900));
/** Constant <code>ADMIN_FUNCTIONS</code> */
public final static Category ADMIN_FUNCTIONS = new Category("Admin Functions", new Integer(2000)); public final static Category ADMIN_FUNCTIONS = new Category("Admin Functions", new Integer(2000));
/** Constant <code>CHALLENGE</code> */
public final static Category CHALLENGE = new Category("Challenge", new Integer(3000)); public final static Category CHALLENGE = new Category("Challenge", new Integer(3000));
private static final List<Category> categories = new ArrayList<Category>(); private static final List<Category> categories = new ArrayList<Category>();
@ -111,10 +133,21 @@ public class Category implements Comparable {
categories.add(CHALLENGE); categories.add(CHALLENGE);
} }
/**
* <p>addCategory.</p>
*
* @param c a {@link org.owasp.webgoat.lessons.Category} object.
*/
public static synchronized void addCategory(Category c) { public static synchronized void addCategory(Category c) {
categories.add(c); categories.add(c);
} }
/**
* <p>Getter for the field <code>category</code>.</p>
*
* @param name a {@link java.lang.String} object.
* @return a {@link org.owasp.webgoat.lessons.Category} object.
*/
public static synchronized Category getCategory(String name) { public static synchronized Category getCategory(String name) {
Iterator<Category> it = categories.iterator(); Iterator<Category> it = categories.iterator();
while (it.hasNext()) { while (it.hasNext()) {
@ -126,11 +159,18 @@ public class Category implements Comparable {
return null; return null;
} }
/**
* <p>Constructor for Category.</p>
*
* @param category a {@link java.lang.String} object.
* @param ranking a {@link java.lang.Integer} object.
*/
public Category(String category, Integer ranking) { public Category(String category, Integer ranking) {
this.category = category; this.category = category;
this.ranking = ranking; this.ranking = ranking;
} }
/** {@inheritDoc} */
@Override @Override
public int compareTo(Object obj) { public int compareTo(Object obj) {
int value = 1; int value = 1;
@ -142,23 +182,41 @@ public class Category implements Comparable {
return value; return value;
} }
/**
* <p>Getter for the field <code>ranking</code>.</p>
*
* @return a {@link java.lang.Integer} object.
*/
public Integer getRanking() { public Integer getRanking() {
return ranking; return ranking;
} }
/**
* <p>Setter for the field <code>ranking</code>.</p>
*
* @param ranking a {@link java.lang.Integer} object.
* @return a {@link java.lang.Integer} object.
*/
public Integer setRanking(Integer ranking) { public Integer setRanking(Integer ranking) {
return this.ranking = ranking; return this.ranking = ranking;
} }
/**
* <p>getName.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getName() { public String getName() {
return category; return category;
} }
/** {@inheritDoc} */
@Override @Override
public boolean equals(Object obj) { public boolean equals(Object obj) {
return (obj instanceof Category) && getName().equals(((Category) obj).getName()); return (obj instanceof Category) && getName().equals(((Category) obj).getName());
} }
/** {@inheritDoc} */
@Override @Override
public String toString() { public String toString() {
return getName(); return getName();

96
webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonAdapter.java
View File

@ -22,45 +22,43 @@ import java.util.ArrayList;
import java.util.List; import java.util.List;
/** /**
* ************************************************************************************************* *************************************************************************************************
* <p> *
* <p> *
* This file is part of WebGoat, an Open Web Application Security Project * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
* utility. For details, please see http://www.owasp.org/ * please see http://www.owasp.org/
* <p> *
* Copyright (c) 2002 - 20014 Bruce Mayhew * Copyright (c) 2002 - 20014 Bruce Mayhew
* <p> *
* This program is free software; you can redistribute it and/or modify it under * This program is free software; you can redistribute it and/or modify it under the terms of the
* the terms of the GNU General Public License as published by the Free Software * GNU General Public License as published by the Free Software Foundation; either version 2 of the
* Foundation; either version 2 of the License, or (at your option) any later * License, or (at your option) any later version.
* version. *
* <p> * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* This program is distributed in the hope that it will be useful, but WITHOUT * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS * General Public License for more details.
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more *
* details. * You should have received a copy of the GNU General Public License along with this program; if
* <p> * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
* You should have received a copy of the GNU General Public License along with * 02111-1307, USA.
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple *
* Place - Suite 330, Boston, MA 02111-1307, USA.
* <p>
* Getting Source ============== * Getting Source ==============
* <p> *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
* for free software projects. * projects.
* <p> *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public abstract class LessonAdapter extends AbstractLesson { public abstract class LessonAdapter extends AbstractLesson {
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param s Description of the Parameter * Description of the Method
* @return Description of the Return Value
*/ */
protected Element createContent(WebSession s) { protected Element createContent(WebSession s) {
// Mark this lesson as completed. // Mark this lesson as completed.
@ -104,32 +102,42 @@ public abstract class LessonAdapter extends AbstractLesson {
return Category.GENERAL; return Category.GENERAL;
} }
/**
* <p>getDefaultHidden.</p>
*
* @return a boolean.
*/
protected boolean getDefaultHidden() { protected boolean getDefaultHidden() {
return false; return false;
} }
private final static Integer DEFAULT_RANKING = new Integer(1000); private final static Integer DEFAULT_RANKING = new Integer(1000);
/**
* <p>getDefaultRanking.</p>
*
* @return a {@link java.lang.Integer} object.
*/
protected Integer getDefaultRanking() { protected Integer getDefaultRanking() {
return DEFAULT_RANKING; return DEFAULT_RANKING;
} }
/** /**
* Gets the hintCount attribute of the LessonAdapter object * {@inheritDoc}
* *
* @return The hintCount value * Gets the hintCount attribute of the LessonAdapter object
*/ */
public int getHintCount(WebSession s) { public int getHintCount(WebSession s) {
return getHints(s).size(); return getHints(s).size();
} }
/** /**
* {@inheritDoc}
*
* Fill in a minor hint that will help people who basically get it, but are * Fill in a minor hint that will help people who basically get it, but are
* stuck on somthing silly. Hints will be returned to the user in the order * stuck on somthing silly. Hints will be returned to the user in the order
* they appear below. The user must click on the "next hint" button before * they appear below. The user must click on the "next hint" button before
* the hint will be displayed. * the hint will be displayed.
*
* @return The hint1 value
*/ */
protected List<String> getHints(WebSession s) { protected List<String> getHints(WebSession s) {
List<String> hints = new ArrayList<String>(); List<String> hints = new ArrayList<String>();
@ -149,12 +157,12 @@ public abstract class LessonAdapter extends AbstractLesson {
} }
/** /**
* {@inheritDoc}
*
* Gets the instructions attribute of the LessonAdapter object. Instructions * Gets the instructions attribute of the LessonAdapter object. Instructions
* will rendered as html and will appear below the control area and above * will rendered as html and will appear below the control area and above
* the actual lesson area. Instructions should provide the user with the * the actual lesson area. Instructions should provide the user with the
* general setup and goal of the lesson. * general setup and goal of the lesson.
*
* @return The instructions value
*/ */
public String getInstructions(WebSession s) { public String getInstructions(WebSession s) {
StringBuffer buff = new StringBuffer(); StringBuffer buff = new StringBuffer();
@ -197,18 +205,34 @@ public abstract class LessonAdapter extends AbstractLesson {
return "Untitled Lesson " + getScreenId(); return "Untitled Lesson " + getScreenId();
} }
/** {@inheritDoc} */
public String getCurrentAction(WebSession s) { public String getCurrentAction(WebSession s) {
return s.getLessonSession(this).getCurrentLessonScreen(); return s.getLessonSession(this).getCurrentLessonScreen();
} }
/** {@inheritDoc} */
public void setCurrentAction(WebSession s, String lessonScreen) { public void setCurrentAction(WebSession s, String lessonScreen) {
s.getLessonSession(this).setCurrentLessonScreen(lessonScreen); s.getLessonSession(this).setCurrentLessonScreen(lessonScreen);
} }
/**
* <p>getSessionAttribute.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param key a {@link java.lang.String} object.
* @return a {@link java.lang.Object} object.
*/
public Object getSessionAttribute(WebSession s, String key) { public Object getSessionAttribute(WebSession s, String key) {
return s.getRequest().getSession().getAttribute(key); return s.getRequest().getSession().getAttribute(key);
} }
/**
* <p>setSessionAttribute.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param key a {@link java.lang.String} object.
* @param value a {@link java.lang.Object} object.
*/
public void setSessionAttribute(WebSession s, String key, Object value) { public void setSessionAttribute(WebSession s, String key, Object value) {
s.getRequest().getSession().setAttribute(key, value); s.getRequest().getSession().setAttribute(key, value);
} }
@ -231,6 +255,8 @@ public abstract class LessonAdapter extends AbstractLesson {
* Gets the credits attribute of the AbstractLesson object * Gets the credits attribute of the AbstractLesson object
* *
* @return The credits value * @return The credits value
* @param text a {@link java.lang.String} object.
* @param e a {@link org.apache.ecs.Element} object.
*/ */
protected Element getCustomCredits(String text, Element e) { protected Element getCustomCredits(String text, Element e) {
Table t = new Table().setCellSpacing(0).setCellPadding(0).setBorder(0).setWidth("90%").setAlign("RIGHT"); Table t = new Table().setCellSpacing(0).setCellPadding(0).setBorder(0).setWidth("90%").setAlign("RIGHT");

39
webgoat-container/src/main/java/org/owasp/webgoat/lessons/RandomLessonAdapter.java
View File

@ -10,11 +10,27 @@ import org.owasp.webgoat.session.RandomLessonTracker;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
/**
* <p>Abstract RandomLessonAdapter class.</p>
*
* @version $Id: $Id
*/
public abstract class RandomLessonAdapter extends LessonAdapter public abstract class RandomLessonAdapter extends LessonAdapter
{ {
/**
* <p>getStages.</p>
*
* @return an array of {@link java.lang.String} objects.
*/
public abstract String[] getStages(); public abstract String[] getStages();
/**
* <p>setStage.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param stage a {@link java.lang.String} object.
*/
public void setStage(WebSession s, String stage) public void setStage(WebSession s, String stage)
{ {
getLessonTracker(s).setStage(stage); getLessonTracker(s).setStage(stage);
@ -33,11 +49,23 @@ public abstract class RandomLessonAdapter extends LessonAdapter
} }
} }
/**
* <p>getStage.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.lang.String} object.
*/
public String getStage(WebSession s) public String getStage(WebSession s)
{ {
return getLessonTracker(s).getStage(); return getLessonTracker(s).getStage();
} }
/**
* <p>setStageComplete.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param stage a {@link java.lang.String} object.
*/
public void setStageComplete(WebSession s, String stage) public void setStageComplete(WebSession s, String stage)
{ {
RandomLessonTracker lt = getLessonTracker(s); RandomLessonTracker lt = getLessonTracker(s);
@ -67,29 +95,40 @@ public abstract class RandomLessonAdapter extends LessonAdapter
} }
} }
/**
* <p>isStageComplete.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param stage a {@link java.lang.String} object.
* @return a boolean.
*/
public boolean isStageComplete(WebSession s, String stage) public boolean isStageComplete(WebSession s, String stage)
{ {
return getLessonTracker(s).hasCompleted(stage); return getLessonTracker(s).hasCompleted(stage);
} }
/** {@inheritDoc} */
@Override @Override
public RandomLessonTracker getLessonTracker(WebSession s) public RandomLessonTracker getLessonTracker(WebSession s)
{ {
return (RandomLessonTracker) super.getLessonTracker(s); return (RandomLessonTracker) super.getLessonTracker(s);
} }
/** {@inheritDoc} */
@Override @Override
public RandomLessonTracker getLessonTracker(WebSession s, AbstractLesson lesson) public RandomLessonTracker getLessonTracker(WebSession s, AbstractLesson lesson)
{ {
return (RandomLessonTracker) super.getLessonTracker(s, lesson); return (RandomLessonTracker) super.getLessonTracker(s, lesson);
} }
/** {@inheritDoc} */
@Override @Override
public RandomLessonTracker getLessonTracker(WebSession s, String userNameOverride) public RandomLessonTracker getLessonTracker(WebSession s, String userNameOverride)
{ {
return (RandomLessonTracker) super.getLessonTracker(s, userNameOverride); return (RandomLessonTracker) super.getLessonTracker(s, userNameOverride);
} }
/** {@inheritDoc} */
@Override @Override
public LessonTracker createLessonTracker() public LessonTracker createLessonTracker()
{ {

74
webgoat-container/src/main/java/org/owasp/webgoat/lessons/SequentialLessonAdapter.java
View File

@ -9,9 +9,20 @@ import org.owasp.webgoat.session.SequentialLessonTracker;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
/**
* <p>Abstract SequentialLessonAdapter class.</p>
*
* @version $Id: $Id
*/
public abstract class SequentialLessonAdapter extends LessonAdapter public abstract class SequentialLessonAdapter extends LessonAdapter
{ {
/**
* <p>setStage.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param stage a int.
*/
public void setStage(WebSession s, int stage) public void setStage(WebSession s, int stage)
{ {
// System.out.println("Changed to stage " + stage); // System.out.println("Changed to stage " + stage);
@ -21,11 +32,22 @@ public abstract class SequentialLessonAdapter extends LessonAdapter
/* /*
* By default returns 1 stage. (non-Javadoc) * By default returns 1 stage. (non-Javadoc)
*/ */
/**
* <p>getStageCount.</p>
*
* @return a int.
*/
public int getStageCount() public int getStageCount()
{ {
return 1; return 1;
} }
/**
* <p>getStage.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a int.
*/
public int getStage(WebSession s) public int getStage(WebSession s)
{ {
int stage = getLessonTracker(s).getStage(); int stage = getLessonTracker(s).getStage();
@ -34,30 +56,40 @@ public abstract class SequentialLessonAdapter extends LessonAdapter
return stage; return stage;
} }
/** {@inheritDoc} */
@Override @Override
public SequentialLessonTracker getLessonTracker(WebSession s) public SequentialLessonTracker getLessonTracker(WebSession s)
{ {
return (SequentialLessonTracker) super.getLessonTracker(s); return (SequentialLessonTracker) super.getLessonTracker(s);
} }
/** {@inheritDoc} */
@Override @Override
public SequentialLessonTracker getLessonTracker(WebSession s, AbstractLesson lesson) public SequentialLessonTracker getLessonTracker(WebSession s, AbstractLesson lesson)
{ {
return (SequentialLessonTracker) super.getLessonTracker(s, lesson); return (SequentialLessonTracker) super.getLessonTracker(s, lesson);
} }
/** {@inheritDoc} */
@Override @Override
public SequentialLessonTracker getLessonTracker(WebSession s, String userNameOverride) public SequentialLessonTracker getLessonTracker(WebSession s, String userNameOverride)
{ {
return (SequentialLessonTracker) super.getLessonTracker(s, userNameOverride); return (SequentialLessonTracker) super.getLessonTracker(s, userNameOverride);
} }
/** {@inheritDoc} */
@Override @Override
public LessonTracker createLessonTracker() public LessonTracker createLessonTracker()
{ {
return new SequentialLessonTracker(); return new SequentialLessonTracker();
} }
/**
* <p>createStagedContent.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link org.apache.ecs.Element} object.
*/
protected Element createStagedContent(WebSession s) protected Element createStagedContent(WebSession s)
{ {
try try
@ -93,6 +125,13 @@ public abstract class SequentialLessonAdapter extends LessonAdapter
return (new StringElement("")); return (new StringElement(""));
} }
/**
* <p>doStage1.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link org.apache.ecs.Element} object.
* @throws java.lang.Exception if any.
*/
protected Element doStage1(WebSession s) throws Exception protected Element doStage1(WebSession s) throws Exception
{ {
ElementContainer ec = new ElementContainer(); ElementContainer ec = new ElementContainer();
@ -100,6 +139,13 @@ public abstract class SequentialLessonAdapter extends LessonAdapter
return ec; return ec;
} }
/**
* <p>doStage2.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link org.apache.ecs.Element} object.
* @throws java.lang.Exception if any.
*/
protected Element doStage2(WebSession s) throws Exception protected Element doStage2(WebSession s) throws Exception
{ {
ElementContainer ec = new ElementContainer(); ElementContainer ec = new ElementContainer();
@ -107,6 +153,13 @@ public abstract class SequentialLessonAdapter extends LessonAdapter
return ec; return ec;
} }
/**
* <p>doStage3.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link org.apache.ecs.Element} object.
* @throws java.lang.Exception if any.
*/
protected Element doStage3(WebSession s) throws Exception protected Element doStage3(WebSession s) throws Exception
{ {
ElementContainer ec = new ElementContainer(); ElementContainer ec = new ElementContainer();
@ -114,6 +167,13 @@ public abstract class SequentialLessonAdapter extends LessonAdapter
return ec; return ec;
} }
/**
* <p>doStage4.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link org.apache.ecs.Element} object.
* @throws java.lang.Exception if any.
*/
protected Element doStage4(WebSession s) throws Exception protected Element doStage4(WebSession s) throws Exception
{ {
ElementContainer ec = new ElementContainer(); ElementContainer ec = new ElementContainer();
@ -121,6 +181,13 @@ public abstract class SequentialLessonAdapter extends LessonAdapter
return ec; return ec;
} }
/**
* <p>doStage5.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link org.apache.ecs.Element} object.
* @throws java.lang.Exception if any.
*/
protected Element doStage5(WebSession s) throws Exception protected Element doStage5(WebSession s) throws Exception
{ {
ElementContainer ec = new ElementContainer(); ElementContainer ec = new ElementContainer();
@ -128,6 +195,13 @@ public abstract class SequentialLessonAdapter extends LessonAdapter
return ec; return ec;
} }
/**
* <p>doStage6.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link org.apache.ecs.Element} object.
* @throws java.lang.Exception if any.
*/
protected Element doStage6(WebSession s) throws Exception protected Element doStage6(WebSession s) throws Exception
{ {
ElementContainer ec = new ElementContainer(); ElementContainer ec = new ElementContainer();

28
webgoat-container/src/main/java/org/owasp/webgoat/lessons/WelcomeScreen.java
View File

@ -13,7 +13,8 @@ import org.apache.ecs.html.Table;
import org.owasp.webgoat.session.*; import org.owasp.webgoat.session.*;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -41,7 +42,8 @@ import org.owasp.webgoat.session.*;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class WelcomeScreen extends Screen public class WelcomeScreen extends Screen
{ {
@ -64,6 +66,11 @@ public class WelcomeScreen extends Screen
{ {
} }
/**
* <p>setup.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
*/
public void setup(WebSession s) public void setup(WebSession s)
{ {
// call createContent first so messages will go somewhere // call createContent first so messages will go somewhere
@ -81,6 +88,12 @@ public class WelcomeScreen extends Screen
setContent(layout); setContent(layout);
} }
/**
* <p>wrapForm.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link org.apache.ecs.Element} object.
*/
protected Element wrapForm(WebSession s) protected Element wrapForm(WebSession s)
{ {
if (s == null) { return new StringElement("Invalid Session"); } if (s == null) { return new StringElement("Invalid Session"); }
@ -97,11 +110,9 @@ public class WelcomeScreen extends Screen
} }
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param s * Description of the Method
* Description of the Parameter
* @return Description of the Return Value
*/ */
protected Element createContent(WebSession s) protected Element createContent(WebSession s)
{ {
@ -138,6 +149,11 @@ public class WelcomeScreen extends Screen
* (non-Javadoc) * (non-Javadoc)
* @see session.Screen#getRole() * @see session.Screen#getRole()
*/ */
/**
* <p>getRole.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getRole() public String getRole()
{ {
return AbstractLesson.USER_ROLE; return AbstractLesson.USER_ROLE;

11
webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/AdminScreen.java
View File

@ -6,7 +6,8 @@ import org.owasp.webgoat.session.Screen;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -34,7 +35,8 @@ import org.owasp.webgoat.session.WebSession;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public abstract class AdminScreen extends Screen public abstract class AdminScreen extends Screen
{ {
@ -86,6 +88,11 @@ public abstract class AdminScreen extends Screen
return ("Admin Information"); return ("Admin Information");
} }
/**
* <p>getRole.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getRole() public String getRole()
{ {
return AbstractLesson.ADMIN_ROLE; return AbstractLesson.ADMIN_ROLE;

17
webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/ProductsAdminScreen.java
View File

@ -13,7 +13,8 @@ import org.owasp.webgoat.session.DatabaseUtilities;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -41,7 +42,8 @@ import org.owasp.webgoat.session.WebSession;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class ProductsAdminScreen extends LessonAdapter public class ProductsAdminScreen extends LessonAdapter
{ {
@ -49,11 +51,9 @@ public class ProductsAdminScreen extends LessonAdapter
private final static String QUERY = "SELECT * FROM product_system_data"; private final static String QUERY = "SELECT * FROM product_system_data";
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param s * Description of the Method
* Description of the Parameter
* @return Description of the Return Value
*/ */
protected Element createContent(WebSession s) protected Element createContent(WebSession s)
{ {
@ -114,6 +114,11 @@ public class ProductsAdminScreen extends LessonAdapter
private final static Integer DEFAULT_RANKING = new Integer(1000); private final static Integer DEFAULT_RANKING = new Integer(1000);
/**
* <p>getDefaultRanking.</p>
*
* @return a {@link java.lang.Integer} object.
*/
protected Integer getDefaultRanking() protected Integer getDefaultRanking()
{ {
return DEFAULT_RANKING; return DEFAULT_RANKING;

17
webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/RefreshDBScreen.java
View File

@ -13,7 +13,8 @@ import org.apache.ecs.html.Table;
import org.owasp.webgoat.session.*; import org.owasp.webgoat.session.*;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -41,7 +42,8 @@ import org.owasp.webgoat.session.*;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class RefreshDBScreen extends LessonAdapter public class RefreshDBScreen extends LessonAdapter
{ {
@ -49,11 +51,9 @@ public class RefreshDBScreen extends LessonAdapter
private final static String REFRESH = "Refresh"; private final static String REFRESH = "Refresh";
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param s * Description of the Method
* Description of the Parameter
* @return Description of the Return Value
*/ */
protected Element createContent(WebSession s) protected Element createContent(WebSession s)
{ {
@ -108,6 +108,11 @@ public class RefreshDBScreen extends LessonAdapter
private final static Integer DEFAULT_RANKING = new Integer(1000); private final static Integer DEFAULT_RANKING = new Integer(1000);
/**
* <p>getDefaultRanking.</p>
*
* @return a {@link java.lang.Integer} object.
*/
protected Integer getDefaultRanking() protected Integer getDefaultRanking()
{ {
return DEFAULT_RANKING; return DEFAULT_RANKING;

23
webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/ReportCardScreen.java
View File

@ -21,7 +21,8 @@ import org.owasp.webgoat.session.UserTracker;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -49,7 +50,8 @@ import org.owasp.webgoat.session.WebSession;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class ReportCardScreen extends LessonAdapter public class ReportCardScreen extends LessonAdapter
{ {
@ -60,11 +62,9 @@ public class ReportCardScreen extends LessonAdapter
protected final static String USERNAME = "Username"; protected final static String USERNAME = "Username";
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param s * Description of the Method
* Description of the Parameter
* @return Description of the Return Value
*/ */
protected Element createContent(WebSession s) protected Element createContent(WebSession s)
{ {
@ -118,6 +118,11 @@ public class ReportCardScreen extends LessonAdapter
private final static Integer DEFAULT_RANKING = new Integer(1000); private final static Integer DEFAULT_RANKING = new Integer(1000);
/**
* <p>getDefaultRanking.</p>
*
* @return a {@link java.lang.Integer} object.
*/
protected Integer getDefaultRanking() protected Integer getDefaultRanking()
{ {
return DEFAULT_RANKING; return DEFAULT_RANKING;
@ -182,11 +187,9 @@ public class ReportCardScreen extends LessonAdapter
} }
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param s * Description of the Method
* Description of the Parameter
* @return Description of the Return Value
*/ */
protected Element makeMessages(WebSession s) protected Element makeMessages(WebSession s)
{ {

34
webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/SummaryReportCardScreen.java
View File

@ -22,7 +22,8 @@ import org.owasp.webgoat.session.UserTracker;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -50,7 +51,8 @@ import org.owasp.webgoat.session.WebSession;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce mayhew <a href="http://code.google.com">WebGoat</a> * @author Bruce mayhew <a href="http://code.google.com">WebGoat</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class SummaryReportCardScreen extends LessonAdapter public class SummaryReportCardScreen extends LessonAdapter
{ {
@ -60,11 +62,9 @@ public class SummaryReportCardScreen extends LessonAdapter
private int totalUsersAdminComplete = 0; private int totalUsersAdminComplete = 0;
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param s * Description of the Method
* Description of the Parameter
* @return Description of the Return Value
*/ */
protected Element createContent(WebSession s) protected Element createContent(WebSession s)
{ {
@ -123,6 +123,12 @@ public class SummaryReportCardScreen extends LessonAdapter
return ec; return ec;
} }
/**
* <p>makeSummary.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link org.apache.ecs.Element} object.
*/
protected Element makeSummary(WebSession s) protected Element makeSummary(WebSession s)
{ {
Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0).setWidth("100%"); Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0).setWidth("100%");
@ -170,6 +176,11 @@ public class SummaryReportCardScreen extends LessonAdapter
private final static Integer DEFAULT_RANKING = new Integer(1000); private final static Integer DEFAULT_RANKING = new Integer(1000);
/**
* <p>getDefaultRanking.</p>
*
* @return a {@link java.lang.Integer} object.
*/
protected Integer getDefaultRanking() protected Integer getDefaultRanking()
{ {
return DEFAULT_RANKING; return DEFAULT_RANKING;
@ -196,11 +207,9 @@ public class SummaryReportCardScreen extends LessonAdapter
} }
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param s * Description of the Method
* Description of the Parameter
* @return Description of the Return Value
*/ */
protected Element makeMessages(WebSession s) protected Element makeMessages(WebSession s)
{ {
@ -307,6 +316,11 @@ public class SummaryReportCardScreen extends LessonAdapter
return (tr); return (tr);
} }
/**
* <p>isEnterprise.</p>
*
* @return a boolean.
*/
public boolean isEnterprise() public boolean isEnterprise()
{ {
return true; return true;

17
webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/UserAdminScreen.java
View File

@ -13,7 +13,8 @@ import org.owasp.webgoat.session.DatabaseUtilities;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -41,7 +42,8 @@ import org.owasp.webgoat.session.WebSession;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class UserAdminScreen extends LessonAdapter public class UserAdminScreen extends LessonAdapter
{ {
@ -49,11 +51,9 @@ public class UserAdminScreen extends LessonAdapter
private final static String QUERY = "SELECT * FROM user_system_data"; private final static String QUERY = "SELECT * FROM user_system_data";
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param s * Description of the Method
* Description of the Parameter
* @return Description of the Return Value
*/ */
protected Element createContent(WebSession s) protected Element createContent(WebSession s)
{ {
@ -94,6 +94,11 @@ public class UserAdminScreen extends LessonAdapter
private final static Integer DEFAULT_RANKING = new Integer(1000); private final static Integer DEFAULT_RANKING = new Integer(1000);
/**
* <p>getDefaultRanking.</p>
*
* @return a {@link java.lang.Integer} object.
*/
protected Integer getDefaultRanking() protected Integer getDefaultRanking()
{ {
return DEFAULT_RANKING; return DEFAULT_RANKING;

25
webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/ViewDatabase.java
View File

@ -15,7 +15,8 @@ import org.apache.ecs.html.Input;
import org.owasp.webgoat.session.*; import org.owasp.webgoat.session.*;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -43,7 +44,8 @@ import org.owasp.webgoat.session.*;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class ViewDatabase extends LessonAdapter public class ViewDatabase extends LessonAdapter
{ {
@ -51,11 +53,9 @@ public class ViewDatabase extends LessonAdapter
private final static String SQL = "sql"; private final static String SQL = "sql";
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param s * Description of the Method
* Description of the Parameter
* @return Description of the Return Value
*/ */
protected Element createContent(WebSession s) protected Element createContent(WebSession s)
{ {
@ -110,15 +110,20 @@ public class ViewDatabase extends LessonAdapter
private final static Integer DEFAULT_RANKING = new Integer(1000); private final static Integer DEFAULT_RANKING = new Integer(1000);
/**
* <p>getDefaultRanking.</p>
*
* @return a {@link java.lang.Integer} object.
*/
protected Integer getDefaultRanking() protected Integer getDefaultRanking()
{ {
return DEFAULT_RANKING; return DEFAULT_RANKING;
} }
/** /**
* Gets the hints attribute of the DatabaseScreen object * {@inheritDoc}
* *
* @return The hints value * Gets the hints attribute of the DatabaseScreen object
*/ */
protected List<String> getHints(WebSession s) protected List<String> getHints(WebSession s)
{ {
@ -129,9 +134,9 @@ public class ViewDatabase extends LessonAdapter
} }
/** /**
* Gets the instructions attribute of the ViewDatabase object * {@inheritDoc}
* *
* @return The instructions value * Gets the instructions attribute of the ViewDatabase object
*/ */
public String getInstructions(WebSession s) public String getInstructions(WebSession s)
{ {

12
webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/WelcomeAdminScreen.java
View File

@ -9,7 +9,8 @@ import org.apache.ecs.html.H1;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -37,7 +38,8 @@ import org.owasp.webgoat.session.WebSession;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class WelcomeAdminScreen extends WelcomeScreen public class WelcomeAdminScreen extends WelcomeScreen
{ {
@ -61,11 +63,9 @@ public class WelcomeAdminScreen extends WelcomeScreen
} }
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param s * Description of the Method
* Description of the Parameter
* @return Description of the Return Value
*/ */
protected Element createContent(WebSession s) protected Element createContent(WebSession s)
{ {

14
webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/Hint.java
View File

@ -28,8 +28,10 @@
package org.owasp.webgoat.lessons.model; package org.owasp.webgoat.lessons.model;
/** /**
* <p>Hint class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
public class Hint { public class Hint {
@ -38,6 +40,8 @@ public class Hint {
private int number; private int number;
/** /**
* <p>Getter for the field <code>hint</code>.</p>
*
* @return the hint * @return the hint
*/ */
public String getHint() { public String getHint() {
@ -45,6 +49,8 @@ public class Hint {
} }
/** /**
* <p>Setter for the field <code>hint</code>.</p>
*
* @param hint the hint to set * @param hint the hint to set
*/ */
public void setHint(String hint) { public void setHint(String hint) {
@ -52,6 +58,8 @@ public class Hint {
} }
/** /**
* <p>Getter for the field <code>lesson</code>.</p>
*
* @return the lesson * @return the lesson
*/ */
public String getLesson() { public String getLesson() {
@ -59,6 +67,8 @@ public class Hint {
} }
/** /**
* <p>Setter for the field <code>lesson</code>.</p>
*
* @param lesson the lesson to set * @param lesson the lesson to set
*/ */
public void setLesson(String lesson) { public void setLesson(String lesson) {
@ -66,6 +76,8 @@ public class Hint {
} }
/** /**
* <p>Getter for the field <code>number</code>.</p>
*
* @return the number * @return the number
*/ */
public int getNumber() { public int getNumber() {
@ -73,6 +85,8 @@ public class Hint {
} }
/** /**
* <p>Setter for the field <code>number</code>.</p>
*
* @param number the number to set * @param number the number to set
*/ */
public void setNumber(int number) { public void setNumber(int number) {

11
webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/HttpBasicsModel.java
View File

@ -33,15 +33,26 @@ package org.owasp.webgoat.lessons.model;
* for illustrative purposes - to demonstrate the pattern that we will * for illustrative purposes - to demonstrate the pattern that we will
* use for more complex lessons. * use for more complex lessons.
* *
* @version $Id: $Id
*/ */
public class HttpBasicsModel { public class HttpBasicsModel {
private String personName; private String personName;
/**
* <p>Getter for the field <code>personName</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getPersonName() { public String getPersonName() {
return personName; return personName;
} }
/**
* <p>Setter for the field <code>personName</code>.</p>
*
* @param personName a {@link java.lang.String} object.
*/
public void setPersonName(String personName) { public void setPersonName(String personName) {
this.personName = personName; this.personName = personName;
} }

36
webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/LessonMenuItem.java
View File

@ -34,8 +34,10 @@ import java.util.ArrayList;
import java.util.List; import java.util.List;
/** /**
* <p>LessonMenuItem class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
public class LessonMenuItem { public class LessonMenuItem {
@ -48,6 +50,8 @@ public class LessonMenuItem {
private boolean showHints = true; private boolean showHints = true;
/** /**
* <p>Getter for the field <code>name</code>.</p>
*
* @return the name * @return the name
*/ */
public String getName() { public String getName() {
@ -55,6 +59,8 @@ public class LessonMenuItem {
} }
/** /**
* <p>Setter for the field <code>name</code>.</p>
*
* @param name the name to set * @param name the name to set
*/ */
public void setName(String name) { public void setName(String name) {
@ -62,6 +68,8 @@ public class LessonMenuItem {
} }
/** /**
* <p>Getter for the field <code>children</code>.</p>
*
* @return the children * @return the children
*/ */
public List<LessonMenuItem> getChildren() { public List<LessonMenuItem> getChildren() {
@ -69,6 +77,8 @@ public class LessonMenuItem {
} }
/** /**
* <p>Setter for the field <code>children</code>.</p>
*
* @param children the children to set * @param children the children to set
*/ */
public void setChildren(List<LessonMenuItem> children) { public void setChildren(List<LessonMenuItem> children) {
@ -76,6 +86,8 @@ public class LessonMenuItem {
} }
/** /**
* <p>Getter for the field <code>type</code>.</p>
*
* @return the type * @return the type
*/ */
public LessonMenuItemType getType() { public LessonMenuItemType getType() {
@ -83,16 +95,24 @@ public class LessonMenuItem {
} }
/** /**
* <p>Setter for the field <code>type</code>.</p>
*
* @param type the type to set * @param type the type to set
*/ */
public void setType(LessonMenuItemType type) { public void setType(LessonMenuItemType type) {
this.type = type; this.type = type;
} }
/**
* <p>addChild.</p>
*
* @param child a {@link org.owasp.webgoat.lessons.model.LessonMenuItem} object.
*/
public void addChild(LessonMenuItem child) { public void addChild(LessonMenuItem child) {
children.add(child); children.add(child);
} }
/** {@inheritDoc} */
@Override @Override
public String toString() { public String toString() {
StringBuilder bldr = new StringBuilder(); StringBuilder bldr = new StringBuilder();
@ -102,6 +122,8 @@ public class LessonMenuItem {
} }
/** /**
* <p>isComplete.</p>
*
* @return the complete * @return the complete
*/ */
public boolean isComplete() { public boolean isComplete() {
@ -109,6 +131,8 @@ public class LessonMenuItem {
} }
/** /**
* <p>Setter for the field <code>complete</code>.</p>
*
* @param complete the complete to set * @param complete the complete to set
*/ */
public void setComplete(boolean complete) { public void setComplete(boolean complete) {
@ -116,6 +140,8 @@ public class LessonMenuItem {
} }
/** /**
* <p>Getter for the field <code>link</code>.</p>
*
* @return the link * @return the link
*/ */
public String getLink() { public String getLink() {
@ -123,6 +149,8 @@ public class LessonMenuItem {
} }
/** /**
* <p>Setter for the field <code>link</code>.</p>
*
* @param link the link to set * @param link the link to set
*/ */
public void setLink(String link) { public void setLink(String link) {
@ -130,6 +158,8 @@ public class LessonMenuItem {
} }
/** /**
* <p>isShowSource.</p>
*
* @return the showSource * @return the showSource
*/ */
public boolean isShowSource() { public boolean isShowSource() {
@ -137,6 +167,8 @@ public class LessonMenuItem {
} }
/** /**
* <p>Setter for the field <code>showSource</code>.</p>
*
* @param showSource the showSource to set * @param showSource the showSource to set
*/ */
public void setShowSource(boolean showSource) { public void setShowSource(boolean showSource) {
@ -144,6 +176,8 @@ public class LessonMenuItem {
} }
/** /**
* <p>isShowHints.</p>
*
* @return the showHints * @return the showHints
*/ */
public boolean isShowHints() { public boolean isShowHints() {
@ -151,6 +185,8 @@ public class LessonMenuItem {
} }
/** /**
* <p>Setter for the field <code>showHints</code>.</p>
*
* @param showHints the showHints to set * @param showHints the showHints to set
*/ */
public void setShowHints(boolean showHints) { public void setShowHints(boolean showHints) {

2
webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/LessonMenuItemType.java
View File

@ -29,8 +29,10 @@
package org.owasp.webgoat.lessons.model; package org.owasp.webgoat.lessons.model;
/** /**
* <p>LessonMenuItemType class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
public enum LessonMenuItemType { public enum LessonMenuItemType {
CATEGORY, CATEGORY,

13
webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/RequestParameter.java
View File

@ -31,20 +31,30 @@
package org.owasp.webgoat.lessons.model; package org.owasp.webgoat.lessons.model;
/** /**
* <p>RequestParameter class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
public class RequestParameter implements Comparable<RequestParameter> { public class RequestParameter implements Comparable<RequestParameter> {
private final String name; private final String name;
private final String value; private final String value;
/**
* <p>Constructor for RequestParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @param value a {@link java.lang.String} object.
*/
public RequestParameter(String name, String value) { public RequestParameter(String name, String value) {
this.name = name; this.name = name;
this.value = value; this.value = value;
} }
/** /**
* <p>Getter for the field <code>name</code>.</p>
*
* @return the name * @return the name
*/ */
public String getName() { public String getName() {
@ -52,12 +62,15 @@ public class RequestParameter implements Comparable<RequestParameter> {
} }
/** /**
* <p>Getter for the field <code>value</code>.</p>
*
* @return the values * @return the values
*/ */
public String getValue() { public String getValue() {
return value; return value;
} }
/** {@inheritDoc} */
@Override @Override
public int compareTo(RequestParameter o) { public int compareTo(RequestParameter o) {
return this.name.compareTo(o.getName()); return this.name.compareTo(o.getName());

6
webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/SourceListing.java
View File

@ -7,14 +7,18 @@
package org.owasp.webgoat.lessons.model; package org.owasp.webgoat.lessons.model;
/** /**
* <p>SourceListing class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
public class SourceListing { public class SourceListing {
private String source; private String source;
/** /**
* <p>Getter for the field <code>source</code>.</p>
*
* @return the source * @return the source
*/ */
public String getSource() { public String getSource() {
@ -22,6 +26,8 @@ public class SourceListing {
} }
/** /**
* <p>Setter for the field <code>source</code>.</p>
*
* @param source the source to set * @param source the source to set
*/ */
public void setSource(String source) { public void setSource(String source) {

72
webgoat-container/src/main/java/org/owasp/webgoat/plugins/LegacyLoader.java
View File

@ -14,37 +14,36 @@ import java.util.List;
import java.util.Set; import java.util.Set;
/** /**
* ************************************************************************************************* *************************************************************************************************
* <p/> *
* <p/> *
* This file is part of WebGoat, an Open Web Application Security Project * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
* utility. For details, please see http://www.owasp.org/ * please see http://www.owasp.org/
* <p/> *
* Copyright (c) 2002 - 20014 Bruce Mayhew * Copyright (c) 2002 - 20014 Bruce Mayhew
* <p/> *
* This program is free software; you can redistribute it and/or modify it under * This program is free software; you can redistribute it and/or modify it under the terms of the
* the terms of the GNU General Public License as published by the Free Software * GNU General Public License as published by the Free Software Foundation; either version 2 of the
* Foundation; either version 2 of the License, or (at your option) any later * License, or (at your option) any later version.
* version. *
* <p/> * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* This program is distributed in the hope that it will be useful, but WITHOUT * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS * General Public License for more details.
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more *
* details. * You should have received a copy of the GNU General Public License along with this program; if
* <p/> * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
* You should have received a copy of the GNU General Public License along with * 02111-1307, USA.
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple *
* Place - Suite 330, Boston, MA 02111-1307, USA.
* <p/>
* Getting Source ============== * Getting Source ==============
* <p/> *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
* for free software projects. * projects.
* <p/> *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class LegacyLoader { public class LegacyLoader {
@ -52,12 +51,15 @@ public class LegacyLoader {
private final List<String> files = new LinkedList<String>(); private final List<String> files = new LinkedList<String>();
/**
* <p>Constructor for LegacyLoader.</p>
*/
public LegacyLoader() { public LegacyLoader() {
} }
/** /**
* Take an absolute file and return the filename. * Take an absolute file and return the filename.
* <p/> *
* Ex. /etc/password becomes password * Ex. /etc/password becomes password
* *
* @param s * @param s
@ -79,7 +81,7 @@ public class LegacyLoader {
/** /**
* Take a class name and return the equivalent file name * Take a class name and return the equivalent file name
* <p/> *
* Ex. org.owasp.webgoat becomes org/owasp/webgoat.java * Ex. org.owasp.webgoat becomes org/owasp/webgoat.java
* *
* @param className * @param className
@ -137,8 +139,8 @@ public class LegacyLoader {
/** /**
* Load all of the filenames into a temporary cache * Load all of the filenames into a temporary cache
* *
* @param context * @param context a {@link javax.servlet.ServletContext} object.
* @param path * @param path a {@link java.lang.String} object.
*/ */
public void loadFiles(ServletContext context, String path) { public void loadFiles(ServletContext context, String path) {
logger.debug("Loading files into cache, path: " + path); logger.debug("Loading files into cache, path: " + path);
@ -163,8 +165,11 @@ public class LegacyLoader {
/** /**
* Instantiate all the lesson objects into a cache * Instantiate all the lesson objects into a cache
* *
* @param path * @param path a {@link java.lang.String} object.
* @param context * @param context a {@link javax.servlet.ServletContext} object.
* @param webgoatContext a {@link org.owasp.webgoat.session.WebgoatContext} object.
* @param properties a {@link org.owasp.webgoat.session.WebgoatProperties} object.
* @return a {@link java.util.List} object.
*/ */
public List<AbstractLesson> loadLessons(WebgoatContext webgoatContext, ServletContext context, String path, WebgoatProperties properties ) { public List<AbstractLesson> loadLessons(WebgoatContext webgoatContext, ServletContext context, String path, WebgoatProperties properties ) {
@ -214,7 +219,8 @@ public class LegacyLoader {
/** /**
* For each lesson, set the source file and lesson file * For each lesson, set the source file and lesson file
* @param lessons *
* @param lessons a {@link java.util.List} object.
*/ */
public void loadResources(List<AbstractLesson> lessons ) { public void loadResources(List<AbstractLesson> lessons ) {
for (AbstractLesson lesson : lessons) { for (AbstractLesson lesson : lessons) {

55
webgoat-container/src/main/java/org/owasp/webgoat/plugins/Plugin.java
View File

@ -20,6 +20,11 @@ import static org.owasp.webgoat.plugins.PluginFileUtils.fileEndsWith;
import static org.owasp.webgoat.plugins.PluginFileUtils.hasParentDirectoryWithName; import static org.owasp.webgoat.plugins.PluginFileUtils.hasParentDirectoryWithName;
import static org.owasp.webgoat.plugins.PluginFileUtils.replaceInFiles; import static org.owasp.webgoat.plugins.PluginFileUtils.replaceInFiles;
/**
* <p>Plugin class.</p>
*
* @version $Id: $Id
*/
public class Plugin { public class Plugin {
private static final String NAME_LESSON_SOLUTION_DIRECTORY = "lessonSolutions"; private static final String NAME_LESSON_SOLUTION_DIRECTORY = "lessonSolutions";
@ -32,12 +37,23 @@ public class Plugin {
private List<File> pluginFiles = Lists.newArrayList(); private List<File> pluginFiles = Lists.newArrayList();
private File lessonSourceFile; private File lessonSourceFile;
/**
* <p>Constructor for Plugin.</p>
*
* @param pluginDirectory a {@link java.nio.file.Path} object.
*/
public Plugin(Path pluginDirectory) { public Plugin(Path pluginDirectory) {
Preconditions.checkNotNull(pluginDirectory, "plugin directory cannot be null"); Preconditions.checkNotNull(pluginDirectory, "plugin directory cannot be null");
Preconditions.checkArgument(Files.exists(pluginDirectory), "directory %s does not exists", pluginDirectory); Preconditions.checkArgument(Files.exists(pluginDirectory), "directory %s does not exists", pluginDirectory);
this.pluginDirectory = pluginDirectory; this.pluginDirectory = pluginDirectory;
} }
/**
* <p>Constructor for Plugin.</p>
*
* @param pluginDirectory a {@link java.nio.file.Path} object.
* @param classes a {@link java.util.List} object.
*/
public Plugin(Path pluginDirectory, List<String> classes) { public Plugin(Path pluginDirectory, List<String> classes) {
this(pluginDirectory); this(pluginDirectory);
findLesson(classes); findLesson(classes);
@ -65,6 +81,11 @@ public class Plugin {
} }
} }
/**
* <p>loadProperties.</p>
*
* @param properties a {@link java.util.List} object.
*/
public void loadProperties(List<Path> properties) { public void loadProperties(List<Path> properties) {
for (Path propertyFile : properties) { for (Path propertyFile : properties) {
LabelProvider.updatePluginResources(propertyFile); LabelProvider.updatePluginResources(propertyFile);
@ -72,6 +93,12 @@ public class Plugin {
} }
} }
/**
* <p>loadFiles.</p>
*
* @param files a {@link java.util.List} object.
* @param reload a boolean.
*/
public void loadFiles(List<Path> files, boolean reload) { public void loadFiles(List<Path> files, boolean reload) {
for (Path file : files) { for (Path file : files) {
if (fileEndsWith(file, ".html") && hasParentDirectoryWithName(file, NAME_LESSON_SOLUTION_DIRECTORY)) { if (fileEndsWith(file, ".html") && hasParentDirectoryWithName(file, NAME_LESSON_SOLUTION_DIRECTORY)) {
@ -90,6 +117,11 @@ public class Plugin {
} }
} }
/**
* <p>rewritePaths.</p>
*
* @param pluginTarget a {@link java.nio.file.Path} object.
*/
public void rewritePaths(Path pluginTarget) { public void rewritePaths(Path pluginTarget) {
try { try {
replaceInFiles(this.lesson.getSimpleName() + "_files", replaceInFiles(this.lesson.getSimpleName() + "_files",
@ -125,6 +157,8 @@ public class Plugin {
/** /**
* Lesson is optional, it is also possible that the supplied jar contains only helper classes. * Lesson is optional, it is also possible that the supplied jar contains only helper classes.
*
* @return a {@link com.google.common.base.Optional} object.
*/ */
public Optional<AbstractLesson> getLesson() { public Optional<AbstractLesson> getLesson() {
try { try {
@ -137,18 +171,39 @@ public class Plugin {
return Optional.absent(); return Optional.absent();
} }
/**
* <p>getLessonSolution.</p>
*
* @param language a {@link java.lang.String} object.
* @return a {@link com.google.common.base.Optional} object.
*/
public Optional<File> getLessonSolution(String language) { public Optional<File> getLessonSolution(String language) {
return Optional.fromNullable(this.solutionLanguageFiles.get(language)); return Optional.fromNullable(this.solutionLanguageFiles.get(language));
} }
/**
* <p>getLessonSolutions.</p>
*
* @return a {@link java.util.Map} object.
*/
public Map<String, File> getLessonSolutions() { public Map<String, File> getLessonSolutions() {
return this.solutionLanguageFiles; return this.solutionLanguageFiles;
} }
/**
* <p>getLessonSource.</p>
*
* @return a {@link com.google.common.base.Optional} object.
*/
public Optional<File> getLessonSource() { public Optional<File> getLessonSource() {
return Optional.fromNullable(lessonSourceFile); return Optional.fromNullable(lessonSourceFile);
} }
/**
* <p>getLessonPlans.</p>
*
* @return a {@link java.util.Map} object.
*/
public Map<String, File> getLessonPlans() { public Map<String, File> getLessonPlans() {
return this.lessonPlansLanguageFiles; return this.lessonPlansLanguageFiles;
} }

7
webgoat-container/src/main/java/org/owasp/webgoat/plugins/PluginBackgroundLoader.java
View File

@ -9,10 +9,16 @@ import java.util.concurrent.ScheduledExecutorService;
import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeUnit;
@WebListener @WebListener
/**
* <p>PluginBackgroundLoader class.</p>
*
* @version $Id: $Id
*/
public class PluginBackgroundLoader implements ServletContextListener { public class PluginBackgroundLoader implements ServletContextListener {
private ScheduledExecutorService scheduler; private ScheduledExecutorService scheduler;
/** {@inheritDoc} */
@Override @Override
public void contextInitialized(ServletContextEvent event) { public void contextInitialized(ServletContextEvent event) {
String pluginPath = event.getServletContext().getRealPath("plugin_lessons"); String pluginPath = event.getServletContext().getRealPath("plugin_lessons");
@ -22,6 +28,7 @@ public class PluginBackgroundLoader implements ServletContextListener {
scheduler.scheduleAtFixedRate(new PluginsLoader(Paths.get(pluginPath), Paths.get(targetPath)), 0, 5, TimeUnit.MINUTES); scheduler.scheduleAtFixedRate(new PluginsLoader(Paths.get(pluginPath), Paths.get(targetPath)), 0, 5, TimeUnit.MINUTES);
} }
/** {@inheritDoc} */
@Override @Override
public void contextDestroyed(ServletContextEvent event) { public void contextDestroyed(ServletContextEvent event) {
scheduler.shutdownNow(); scheduler.shutdownNow();

27
webgoat-container/src/main/java/org/owasp/webgoat/plugins/PluginExtractor.java
View File

@ -25,6 +25,8 @@ import static org.owasp.webgoat.plugins.PluginFileUtils.hasParentDirectoryWithNa
/** /**
* Extract the jar file and place them in the system temp directory in the folder webgoat and collect the files * Extract the jar file and place them in the system temp directory in the folder webgoat and collect the files
* and classes. * and classes.
*
* @version $Id: $Id
*/ */
public class PluginExtractor { public class PluginExtractor {
@ -34,10 +36,20 @@ public class PluginExtractor {
private final List<Path> files = new ArrayList<>(); private final List<Path> files = new ArrayList<>();
private final List<Path> properties = new ArrayList<>(); private final List<Path> properties = new ArrayList<>();
/**
* <p>Constructor for PluginExtractor.</p>
*
* @param pluginArchive a {@link java.nio.file.Path} object.
*/
public PluginExtractor(Path pluginArchive) { public PluginExtractor(Path pluginArchive) {
this.pluginArchive = pluginArchive; this.pluginArchive = pluginArchive;
} }
/**
* <p>extract.</p>
*
* @param target a {@link java.nio.file.Path} object.
*/
public void extract(final Path target) { public void extract(final Path target) {
try (FileSystem zip = createZipFileSystem()) { try (FileSystem zip = createZipFileSystem()) {
final Path root = zip.getPath("/"); final Path root = zip.getPath("/");
@ -63,14 +75,29 @@ public class PluginExtractor {
} }
} }
/**
* <p>Getter for the field <code>classes</code>.</p>
*
* @return a {@link java.util.List} object.
*/
public List<String> getClasses() { public List<String> getClasses() {
return this.classes; return this.classes;
} }
/**
* <p>Getter for the field <code>files</code>.</p>
*
* @return a {@link java.util.List} object.
*/
public List<Path> getFiles() { public List<Path> getFiles() {
return this.files; return this.files;
} }
/**
* <p>Getter for the field <code>properties</code>.</p>
*
* @return a {@link java.util.List} object.
*/
public List<Path> getProperties() { public List<Path> getProperties() {
return this.properties; return this.properties;
} }

64
webgoat-container/src/main/java/org/owasp/webgoat/plugins/PluginFileUtils.java
View File

@ -14,12 +14,31 @@ import java.util.ArrayList;
import java.util.Collection; import java.util.Collection;
import java.util.List; import java.util.List;
/**
* <p>PluginFileUtils class.</p>
*
* @version $Id: $Id
*/
public class PluginFileUtils { public class PluginFileUtils {
/**
* <p>fileEndsWith.</p>
*
* @param p a {@link java.nio.file.Path} object.
* @param s a {@link java.lang.String} object.
* @return a boolean.
*/
public static boolean fileEndsWith(Path p, String s) { public static boolean fileEndsWith(Path p, String s) {
return p.getFileName().toString().endsWith(s); return p.getFileName().toString().endsWith(s);
} }
/**
* <p>fileEndsWith.</p>
*
* @param p a {@link java.nio.file.Path} object.
* @param suffixes a {@link java.lang.String} object.
* @return a boolean.
*/
public static boolean fileEndsWith(Path p, String... suffixes) { public static boolean fileEndsWith(Path p, String... suffixes) {
for (String suffix : suffixes) { for (String suffix : suffixes) {
if (fileEndsWith(p, suffix)) { if (fileEndsWith(p, suffix)) {
@ -29,6 +48,13 @@ public class PluginFileUtils {
return false; return false;
} }
/**
* <p>hasParentDirectoryWithName.</p>
*
* @param p a {@link java.nio.file.Path} object.
* @param s a {@link java.lang.String} object.
* @return a boolean.
*/
public static boolean hasParentDirectoryWithName(Path p, String s) { public static boolean hasParentDirectoryWithName(Path p, String s) {
if (p == null || p.getParent() == null || p.getParent().equals(p.getRoot())) { if (p == null || p.getParent() == null || p.getParent().equals(p.getRoot())) {
return false; return false;
@ -39,6 +65,13 @@ public class PluginFileUtils {
return hasParentDirectoryWithName(p.getParent(), s); return hasParentDirectoryWithName(p.getParent(), s);
} }
/**
* <p>createDirsIfNotExists.</p>
*
* @param p a {@link java.nio.file.Path} object.
* @return a {@link java.nio.file.Path} object.
* @throws java.io.IOException if any.
*/
public static Path createDirsIfNotExists(Path p) throws IOException { public static Path createDirsIfNotExists(Path p) throws IOException {
if (Files.notExists(p)) { if (Files.notExists(p)) {
Files.createDirectories(p); Files.createDirectories(p);
@ -46,6 +79,13 @@ public class PluginFileUtils {
return p; return p;
} }
/**
* <p>getFilesInDirectory.</p>
*
* @param directory a {@link java.nio.file.Path} object.
* @return a {@link java.util.List} object.
* @throws java.io.IOException if any.
*/
public static List<Path> getFilesInDirectory(Path directory) throws IOException { public static List<Path> getFilesInDirectory(Path directory) throws IOException {
List<Path> files = new ArrayList<>(); List<Path> files = new ArrayList<>();
DirectoryStream<Path> dirStream; DirectoryStream<Path> dirStream;
@ -57,6 +97,14 @@ public class PluginFileUtils {
return files; return files;
} }
/**
* <p>replaceInFiles.</p>
*
* @param replace a {@link java.lang.String} object.
* @param with a {@link java.lang.String} object.
* @param files a {@link java.util.Collection} object.
* @throws java.io.IOException if any.
*/
public static void replaceInFiles(String replace, String with, Collection<File> files) throws IOException { public static void replaceInFiles(String replace, String with, Collection<File> files) throws IOException {
Preconditions.checkNotNull(replace); Preconditions.checkNotNull(replace);
Preconditions.checkNotNull(with); Preconditions.checkNotNull(with);
@ -67,6 +115,14 @@ public class PluginFileUtils {
} }
} }
/**
* <p>replaceInFile.</p>
*
* @param replace a {@link java.lang.String} object.
* @param with a {@link java.lang.String} object.
* @param file a {@link java.nio.file.Path} object.
* @throws java.io.IOException if any.
*/
public static void replaceInFile(String replace, String with, Path file) throws IOException { public static void replaceInFile(String replace, String with, Path file) throws IOException {
Preconditions.checkNotNull(replace); Preconditions.checkNotNull(replace);
Preconditions.checkNotNull(with); Preconditions.checkNotNull(with);
@ -78,6 +134,14 @@ public class PluginFileUtils {
Files.write(file, fileAsString.getBytes()); Files.write(file, fileAsString.getBytes());
} }
/**
* <p>writeFile.</p>
*
* @param targetFile a {@link java.nio.file.Path} object.
* @param bytes an array of byte.
* @param options a {@link java.nio.file.OpenOption} object.
* @throws java.io.IOException if any.
*/
public static void writeFile(Path targetFile, byte[] bytes, OpenOption... options) throws IOException { public static void writeFile(Path targetFile, byte[] bytes, OpenOption... options) throws IOException {
createDirsIfNotExists(targetFile.getParent()); createDirsIfNotExists(targetFile.getParent());
if (!Files.exists(targetFile)) { if (!Files.exists(targetFile)) {

11
webgoat-container/src/main/java/org/owasp/webgoat/plugins/PluginLoadingFailure.java
View File

@ -1,7 +1,18 @@
package org.owasp.webgoat.plugins; package org.owasp.webgoat.plugins;
/**
* <p>PluginLoadingFailure class.</p>
*
* @version $Id: $Id
*/
public class PluginLoadingFailure extends RuntimeException { public class PluginLoadingFailure extends RuntimeException {
/**
* <p>Constructor for PluginLoadingFailure.</p>
*
* @param message a {@link java.lang.String} object.
* @param e a {@link java.lang.Exception} object.
*/
public PluginLoadingFailure(String message, Exception e) { public PluginLoadingFailure(String message, Exception e) {
super(message, e); super(message, e);
} }

19
webgoat-container/src/main/java/org/owasp/webgoat/plugins/PluginsLoader.java
View File

@ -22,14 +22,26 @@ import java.util.concurrent.ExecutorCompletionService;
import java.util.concurrent.ExecutorService; import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors; import java.util.concurrent.Executors;
/**
* <p>PluginsLoader class.</p>
*
* @version $Id: $Id
*/
public class PluginsLoader implements Runnable { public class PluginsLoader implements Runnable {
/** Constant <code>WEBGOAT_PLUGIN_EXTENSION="jar"</code> */
protected static final String WEBGOAT_PLUGIN_EXTENSION = "jar"; protected static final String WEBGOAT_PLUGIN_EXTENSION = "jar";
private final Logger logger = LoggerFactory.getLogger(this.getClass()); private final Logger logger = LoggerFactory.getLogger(this.getClass());
private final Path pluginSource; private final Path pluginSource;
private Path pluginTarget; private Path pluginTarget;
/**
* <p>Constructor for PluginsLoader.</p>
*
* @param pluginSource a {@link java.nio.file.Path} object.
* @param pluginTarget a {@link java.nio.file.Path} object.
*/
public PluginsLoader(Path pluginSource, Path pluginTarget) { public PluginsLoader(Path pluginSource, Path pluginTarget) {
Preconditions.checkNotNull(pluginSource, "plugin source cannot be null"); Preconditions.checkNotNull(pluginSource, "plugin source cannot be null");
Preconditions.checkNotNull(pluginTarget, "plugin target cannot be null"); Preconditions.checkNotNull(pluginTarget, "plugin target cannot be null");
@ -38,6 +50,12 @@ public class PluginsLoader implements Runnable {
this.pluginTarget = pluginTarget; this.pluginTarget = pluginTarget;
} }
/**
* <p>loadPlugins.</p>
*
* @param reload a boolean.
* @return a {@link java.util.List} object.
*/
public List<Plugin> loadPlugins(final boolean reload) { public List<Plugin> loadPlugins(final boolean reload) {
final PluginClassLoader cl = (PluginClassLoader) Thread.currentThread().getContextClassLoader(); final PluginClassLoader cl = (PluginClassLoader) Thread.currentThread().getContextClassLoader();
List<Plugin> plugins = Lists.newArrayList(); List<Plugin> plugins = Lists.newArrayList();
@ -109,6 +127,7 @@ public class PluginsLoader implements Runnable {
return extractorCallables; return extractorCallables;
} }
/** {@inheritDoc} */
@Override @Override
public void run() { public void run() {
loadPlugins(true); loadPlugins(true);

6
webgoat-container/src/main/java/org/owasp/webgoat/service/ApplicationService.java
View File

@ -37,8 +37,10 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
/** /**
* <p>ApplicationService class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class ApplicationService extends BaseService { public class ApplicationService extends BaseService {
@ -46,8 +48,8 @@ public class ApplicationService extends BaseService {
/** /**
* Returns global application info * Returns global application info
* *
* @param session * @param session a {@link javax.servlet.http.HttpSession} object.
* @return * @return a {@link org.owasp.webgoat.application.Application} object.
*/ */
@RequestMapping(value = "/application.mvc", produces = "application/json") @RequestMapping(value = "/application.mvc", produces = "application/json")
public @ResponseBody public @ResponseBody

21
webgoat-container/src/main/java/org/owasp/webgoat/service/BaseService.java
View File

@ -44,14 +44,23 @@ import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.ResponseStatus; import org.springframework.web.bind.annotation.ResponseStatus;
/** /**
* <p>Abstract BaseService class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@RequestMapping("/service") @RequestMapping("/service")
public abstract class BaseService { public abstract class BaseService {
private static final Logger logger = LoggerFactory.getLogger(BaseService.class); private static final Logger logger = LoggerFactory.getLogger(BaseService.class);
/**
* <p>handleException.</p>
*
* @param request a {@link javax.servlet.http.HttpServletRequest} object.
* @param ex a {@link java.lang.Exception} object.
* @return a {@link org.owasp.webgoat.service.ExceptionInfo} object.
*/
@ExceptionHandler(Exception.class) @ExceptionHandler(Exception.class)
@ResponseStatus(value = HttpStatus.I_AM_A_TEAPOT) @ResponseStatus(value = HttpStatus.I_AM_A_TEAPOT)
public @ResponseBody public @ResponseBody
@ -66,6 +75,12 @@ public abstract class BaseService {
return response; return response;
} }
/**
* <p>getWebSession.</p>
*
* @param session a {@link javax.servlet.http.HttpSession} object.
* @return a {@link org.owasp.webgoat.session.WebSession} object.
*/
public WebSession getWebSession(HttpSession session) { public WebSession getWebSession(HttpSession session) {
WebSession ws; WebSession ws;
Object o = session.getAttribute(WebSession.SESSION); Object o = session.getAttribute(WebSession.SESSION);
@ -79,6 +94,12 @@ public abstract class BaseService {
return ws; return ws;
} }
/**
* <p>getStringStackTrace.</p>
*
* @param t a {@link java.lang.Throwable} object.
* @return a {@link java.lang.String} object.
*/
public String getStringStackTrace(Throwable t){ public String getStringStackTrace(Throwable t){
StringWriter sw = new StringWriter(); StringWriter sw = new StringWriter();
PrintWriter pw = new PrintWriter(sw); PrintWriter pw = new PrintWriter(sw);

10
webgoat-container/src/main/java/org/owasp/webgoat/service/CookieService.java
View File

@ -42,8 +42,10 @@ import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.servlet.ModelAndView; import org.springframework.web.servlet.ModelAndView;
/** /**
* <p>CookieService class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class CookieService extends BaseService { public class CookieService extends BaseService {
@ -51,8 +53,8 @@ public class CookieService extends BaseService {
/** /**
* Returns cookies for last attack * Returns cookies for last attack
* *
* @param session * @param session a {@link javax.servlet.http.HttpSession} object.
* @return * @return a {@link java.util.List} object.
*/ */
@RequestMapping(value = "/cookie.mvc", produces = "application/json") @RequestMapping(value = "/cookie.mvc", produces = "application/json")
public @ResponseBody public @ResponseBody
@ -65,8 +67,8 @@ public class CookieService extends BaseService {
/** /**
* Returns cookies and params for current lesson * Returns cookies and params for current lesson
* *
* @param session * @param session a {@link javax.servlet.http.HttpSession} object.
* @return * @return a {@link org.springframework.web.servlet.ModelAndView} object.
*/ */
@RequestMapping(value = "/cookies_widget.mvc", produces = "text/html") @RequestMapping(value = "/cookies_widget.mvc", produces = "text/html")
public ModelAndView showCookiesAndParamsAsHtml(HttpSession session) { public ModelAndView showCookiesAndParamsAsHtml(HttpSession session) {

7
webgoat-container/src/main/java/org/owasp/webgoat/service/DummyService.java
View File

@ -34,12 +34,19 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
/** /**
* <p>DummyService class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class DummyService extends BaseService{ public class DummyService extends BaseService{
/**
* <p>firstNames.</p>
*
* @return a {@link java.util.List} object.
*/
@RequestMapping(value = "/first.mvc", produces = "application/json") @RequestMapping(value = "/first.mvc", produces = "application/json")
public @ResponseBody public @ResponseBody
List<String> firstNames() { List<String> firstNames() {

22
webgoat-container/src/main/java/org/owasp/webgoat/service/ExceptionInfo.java
View File

@ -28,26 +28,48 @@
package org.owasp.webgoat.service; package org.owasp.webgoat.service;
/** /**
* <p>ExceptionInfo class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
public class ExceptionInfo { public class ExceptionInfo {
private String url; private String url;
private String message; private String message;
/**
* <p>Getter for the field <code>url</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getUrl() { public String getUrl() {
return url; return url;
} }
/**
* <p>Setter for the field <code>url</code>.</p>
*
* @param url a {@link java.lang.String} object.
*/
public void setUrl(String url) { public void setUrl(String url) {
this.url = url; this.url = url;
} }
/**
* <p>Getter for the field <code>message</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getMessage() { public String getMessage() {
return message; return message;
} }
/**
* <p>Setter for the field <code>message</code>.</p>
*
* @param message a {@link java.lang.String} object.
*/
public void setMessage(String message) { public void setMessage(String message) {
this.message = message; this.message = message;
} }

12
webgoat-container/src/main/java/org/owasp/webgoat/service/HintService.java
View File

@ -17,8 +17,10 @@ import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.servlet.ModelAndView; import org.springframework.web.servlet.ModelAndView;
/** /**
* <p>HintService class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class HintService extends BaseService { public class HintService extends BaseService {
@ -26,8 +28,8 @@ public class HintService extends BaseService {
/** /**
* Returns hints for current lesson * Returns hints for current lesson
* *
* @param session * @param session a {@link javax.servlet.http.HttpSession} object.
* @return * @return a {@link java.util.List} object.
*/ */
@RequestMapping(value = "/hint.mvc", produces = "application/json") @RequestMapping(value = "/hint.mvc", produces = "application/json")
public @ResponseBody public @ResponseBody
@ -55,6 +57,12 @@ public class HintService extends BaseService {
return listHints; return listHints;
} }
/**
* <p>showHintsAsHtml.</p>
*
* @param session a {@link javax.servlet.http.HttpSession} object.
* @return a {@link org.springframework.web.servlet.ModelAndView} object.
*/
@RequestMapping(value = "/hint_widget.mvc", produces = "text/html") @RequestMapping(value = "/hint_widget.mvc", produces = "text/html")
public public
ModelAndView showHintsAsHtml(HttpSession session) { ModelAndView showHintsAsHtml(HttpSession session) {

6
webgoat-container/src/main/java/org/owasp/webgoat/service/LessonMenuService.java
View File

@ -47,8 +47,10 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
/** /**
* <p>LessonMenuService class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class LessonMenuService extends BaseService { public class LessonMenuService extends BaseService {
@ -58,8 +60,8 @@ public class LessonMenuService extends BaseService {
/** /**
* Returns the lesson menu which is used to build the left nav * Returns the lesson menu which is used to build the left nav
* *
* @param session * @param session a {@link javax.servlet.http.HttpSession} object.
* @return * @return a {@link java.util.List} object.
*/ */
@RequestMapping(value = "/lessonmenu.mvc", produces = "application/json") @RequestMapping(value = "/lessonmenu.mvc", produces = "application/json")
public @ResponseBody public @ResponseBody

6
webgoat-container/src/main/java/org/owasp/webgoat/service/LessonPlanService.java
View File

@ -42,8 +42,10 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
/** /**
* <p>LessonPlanService class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class LessonPlanService extends BaseService { public class LessonPlanService extends BaseService {
@ -51,8 +53,8 @@ public class LessonPlanService extends BaseService {
/** /**
* Returns source for current attack * Returns source for current attack
* *
* @param session * @param session a {@link javax.servlet.http.HttpSession} object.
* @return * @return a {@link java.lang.String} object.
*/ */
@RequestMapping(value = "/lessonplan.mvc", produces = "application/html") @RequestMapping(value = "/lessonplan.mvc", produces = "application/html")
public @ResponseBody public @ResponseBody

11
webgoat-container/src/main/java/org/owasp/webgoat/service/LessonTitleService.java
View File

@ -10,13 +10,18 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
@Controller @Controller
/**
* <p>LessonTitleService class.</p>
*
* @version $Id: $Id
*/
public class LessonTitleService extends BaseService { public class LessonTitleService extends BaseService {
/** /**
* Returns the title for the current attack * Returns the title for the current attack
* *
* @param session * @param session a {@link javax.servlet.http.HttpSession} object.
* @return * @return a {@link java.lang.String} object.
*/ */
@RequestMapping(value = "/lessontitle.mvc", produces = "application/html") @RequestMapping(value = "/lessontitle.mvc", produces = "application/html")
public @ResponseBody public @ResponseBody

6
webgoat-container/src/main/java/org/owasp/webgoat/service/ParameterService.java
View File

@ -43,8 +43,10 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
/** /**
* <p>ParameterService class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class ParameterService extends BaseService { public class ParameterService extends BaseService {
@ -54,8 +56,8 @@ public class ParameterService extends BaseService {
/** /**
* Returns request parameters for last attack * Returns request parameters for last attack
* *
* @param session * @param session a {@link javax.servlet.http.HttpSession} object.
* @return * @return a {@link java.util.List} object.
*/ */
@RequestMapping(value = "/parameter.mvc", produces = "application/json") @RequestMapping(value = "/parameter.mvc", produces = "application/json")
public @ResponseBody public @ResponseBody

6
webgoat-container/src/main/java/org/owasp/webgoat/service/RestartLessonService.java
View File

@ -34,8 +34,10 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
/** /**
* <p>RestartLessonService class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class RestartLessonService extends BaseService { public class RestartLessonService extends BaseService {
@ -43,8 +45,8 @@ public class RestartLessonService extends BaseService {
/** /**
* Returns current lesson * Returns current lesson
* *
* @param session * @param session a {@link javax.servlet.http.HttpSession} object.
* @return * @return a {@link java.lang.String} object.
*/ */
@RequestMapping(value = "/restartlesson.mvc", produces = "text/text") @RequestMapping(value = "/restartlesson.mvc", produces = "text/text")
public @ResponseBody public @ResponseBody

7
webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java
View File

@ -17,8 +17,10 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
/** /**
* <p>SessionService class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class SessionService extends BaseService { public class SessionService extends BaseService {
@ -26,8 +28,9 @@ public class SessionService extends BaseService {
/** /**
* Returns hints for current lesson * Returns hints for current lesson
* *
* @param session * @param session a {@link javax.servlet.http.HttpSession} object.
* @return * @param request a {@link javax.servlet.http.HttpServletRequest} object.
* @return a {@link java.lang.String} object.
*/ */
@RequestMapping(value = "/session.mvc", produces = "application/json") @RequestMapping(value = "/session.mvc", produces = "application/json")
public @ResponseBody public @ResponseBody

12
webgoat-container/src/main/java/org/owasp/webgoat/service/SolutionService.java
View File

@ -39,8 +39,10 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
/** /**
* <p>SolutionService class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class SolutionService extends BaseService { public class SolutionService extends BaseService {
@ -48,8 +50,8 @@ public class SolutionService extends BaseService {
/** /**
* Returns solution for current attack * Returns solution for current attack
* *
* @param session * @param session a {@link javax.servlet.http.HttpSession} object.
* @return * @return a {@link java.lang.String} object.
*/ */
@RequestMapping(value = "/solution.mvc", produces = "text/html") @RequestMapping(value = "/solution.mvc", produces = "text/html")
public @ResponseBody public @ResponseBody
@ -59,6 +61,12 @@ public class SolutionService extends BaseService {
return source; return source;
} }
/**
* <p>getSolution.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.lang.String} object.
*/
protected String getSolution(WebSession s) { protected String getSolution(WebSession s) {
String source = null; String source = null;

6
webgoat-container/src/main/java/org/owasp/webgoat/service/SourceService.java
View File

@ -44,8 +44,10 @@ import static org.owasp.webgoat.LessonSource.END_SOURCE_SKIP;
import static org.owasp.webgoat.LessonSource.START_SOURCE_SKIP; import static org.owasp.webgoat.LessonSource.START_SOURCE_SKIP;
/** /**
* <p>SourceService class.</p>
* *
* @author rlawson * @author rlawson
* @version $Id: $Id
*/ */
@Controller @Controller
public class SourceService extends BaseService { public class SourceService extends BaseService {
@ -53,8 +55,8 @@ public class SourceService extends BaseService {
/** /**
* Returns source for current attack * Returns source for current attack
* *
* @param session * @param session a {@link javax.servlet.http.HttpSession} object.
* @return * @return a {@link java.lang.String} object.
*/ */
@RequestMapping(value = "/source.mvc", produces = "application/text") @RequestMapping(value = "/source.mvc", produces = "application/text")
public @ResponseBody public @ResponseBody

73
webgoat-container/src/main/java/org/owasp/webgoat/servlets/Controller.java
View File

@ -1 +1,72 @@
package org.owasp.webgoat.servlets; import java.io.IOException; import javax.servlet.ServletException; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; /** * ************************************************************************************************* * * * This file is part of WebGoat, an Open Web Application Security Project * utility. For details, please see http://www.owasp.org/ * * Copyright (c) 2002 - 20014 Bruce Mayhew * * This program is free software; you can redistribute it and/or modify it under * the terms of the GNU General Public License as published by the Free Software * Foundation; either version 2 of the License, or (at your option) any later * version. * * This program is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. * * You should have received a copy of the GNU General Public License along with * this program; if not, write to the Free Software Foundation, Inc., 59 Temple * Place - Suite 330, Boston, MA 02111-1307, USA. * * Getting Source ============== * * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository * for free software projects. * * For details, please see http://webgoat.github.io */ public class Controller extends HttpServlet { private static final long serialVersionUID = 1L; protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { doPost(request, response); } protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String userAgent = request.getHeader("user-agent"); String clientBrowser = "Not known!"; if (userAgent != null) { clientBrowser = userAgent; } request.setAttribute("client.browser", clientBrowser); request.getRequestDispatcher("/view.jsp").forward(request, response); } } package org.owasp.webgoat.servlets;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
* *************************************************************************************************
*
*
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
*
* Copyright (c) 2002 - 20014 Bruce Mayhew
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
*
* Getting Source ==============
*
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* for free software projects.
*
* For details, please see http://webgoat.github.io
*
* @version $Id: $Id
*/
public class Controller extends HttpServlet {
private static final long serialVersionUID = 1L;
/** {@inheritDoc} */
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
doPost(request, response);
}
/** {@inheritDoc} */
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException,
IOException {
String userAgent = request.getHeader("user-agent");
String clientBrowser = "Not known!";
if (userAgent != null) {
clientBrowser = userAgent;
}
request.setAttribute("client.browser", clientBrowser);
request.getRequestDispatcher("/view.jsp").forward(request, response);
}
}

21
webgoat-container/src/main/java/org/owasp/webgoat/session/Authorization.java
View File

@ -5,7 +5,8 @@ import java.util.Hashtable;
import java.util.Map; import java.util.Map;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -31,21 +32,39 @@ import java.util.Map;
* projects. * projects.
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
*
* * @version $Id: $Id
*/ */
public class Authorization public class Authorization
{ {
Map<Integer, Integer> permissions = new Hashtable<Integer, Integer>(); Map<Integer, Integer> permissions = new Hashtable<Integer, Integer>();
/**
* <p>Constructor for Authorization.</p>
*/
public Authorization() public Authorization()
{ {
} }
/**
* <p>setPermission.</p>
*
* @param userId a int.
* @param functionId a int.
*/
public void setPermission(int userId, int functionId) public void setPermission(int userId, int functionId)
{ {
permissions.put(new Integer(userId), new Integer(functionId)); permissions.put(new Integer(userId), new Integer(functionId));
} }
/**
* <p>isAllowed.</p>
*
* @param userId a int.
* @param functionId a int.
* @return a boolean.
*/
public boolean isAllowed(int userId, int functionId) public boolean isAllowed(int userId, int functionId)
{ {
return (permissions.get(new Integer(userId)) != null); return (permissions.get(new Integer(userId)) != null);

105
webgoat-container/src/main/java/org/owasp/webgoat/session/Course.java
View File

@ -30,37 +30,36 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory; import org.slf4j.LoggerFactory;
/** /**
* ************************************************************************************************* *************************************************************************************************
* <p/> *
* <p/> *
* This file is part of WebGoat, an Open Web Application Security Project * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
* utility. For details, please see http://www.owasp.org/ * please see http://www.owasp.org/
* <p/> *
* Copyright (c) 2002 - 20014 Bruce Mayhew * Copyright (c) 2002 - 20014 Bruce Mayhew
* <p/> *
* This program is free software; you can redistribute it and/or modify it under * This program is free software; you can redistribute it and/or modify it under the terms of the
* the terms of the GNU General Public License as published by the Free Software * GNU General Public License as published by the Free Software Foundation; either version 2 of the
* Foundation; either version 2 of the License, or (at your option) any later * License, or (at your option) any later version.
* version. *
* <p/> * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* This program is distributed in the hope that it will be useful, but WITHOUT * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS * General Public License for more details.
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more *
* details. * You should have received a copy of the GNU General Public License along with this program; if
* <p/> * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
* You should have received a copy of the GNU General Public License along with * 02111-1307, USA.
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple *
* Place - Suite 330, Boston, MA 02111-1307, USA.
* <p/>
* Getting Source ============== * Getting Source ==============
* <p/> *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
* for free software projects. * projects.
* <p/> *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class Course { public class Course {
@ -76,6 +75,9 @@ public class Course {
private WebgoatContext webgoatContext; private WebgoatContext webgoatContext;
/**
* <p>Constructor for Course.</p>
*/
public Course() { public Course() {
try { try {
properties = new WebgoatProperties(PROPERTIES_FILENAME); properties = new WebgoatProperties(PROPERTIES_FILENAME);
@ -86,7 +88,7 @@ public class Course {
/** /**
* Take an absolute file and return the filename. * Take an absolute file and return the filename.
* <p/> *
* Ex. /etc/password becomes password * Ex. /etc/password becomes password
* *
* @param s * @param s
@ -108,7 +110,7 @@ public class Course {
/** /**
* Take a class name and return the equivalent file name * Take a class name and return the equivalent file name
* <p/> *
* Ex. org.owasp.webgoat becomes org/owasp/webgoat.java * Ex. org.owasp.webgoat becomes org/owasp/webgoat.java
* *
* @param className * @param className
@ -190,9 +192,9 @@ public class Course {
/** /**
* Gets the lesson attribute of the Course object * Gets the lesson attribute of the Course object
* *
* @param s * @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param lessonId Description of the Parameter * @param lessonId Description of the Parameter
* @param roles * @param roles a {@link java.util.List} object.
* @return The lesson value * @return The lesson value
*/ */
public AbstractLesson getLesson(WebSession s, int lessonId, List<String> roles) { public AbstractLesson getLesson(WebSession s, int lessonId, List<String> roles) {
@ -214,12 +216,27 @@ public class Course {
return null; return null;
} }
/**
* <p>getLesson.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param lessonId a int.
* @param role a {@link java.lang.String} object.
* @return a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
*/
public AbstractLesson getLesson(WebSession s, int lessonId, String role) { public AbstractLesson getLesson(WebSession s, int lessonId, String role) {
List<String> roles = new ArrayList<String>(); List<String> roles = new ArrayList<String>();
roles.add(role); roles.add(role);
return getLesson(s, lessonId, roles); return getLesson(s, lessonId, roles);
} }
/**
* <p>Getter for the field <code>lessons</code>.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param role a {@link java.lang.String} object.
* @return a {@link java.util.List} object.
*/
public List getLessons(WebSession s, String role) { public List getLessons(WebSession s, String role) {
List<String> roles = new ArrayList<String>(); List<String> roles = new ArrayList<String>();
roles.add(role); roles.add(role);
@ -229,8 +246,8 @@ public class Course {
/** /**
* Gets the lessons attribute of the Course object * Gets the lessons attribute of the Course object
* *
* @param s * @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param roles * @param roles a {@link java.util.List} object.
* @return The lessons value * @return The lessons value
*/ */
public List<AbstractLesson> getLessons(WebSession s, List<String> roles) { public List<AbstractLesson> getLessons(WebSession s, List<String> roles) {
@ -266,12 +283,28 @@ public class Course {
return lessonList; return lessonList;
} }
/**
* <p>Getter for the field <code>lessons</code>.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param category a {@link org.owasp.webgoat.lessons.Category} object.
* @param role a {@link java.lang.String} object.
* @return a {@link java.util.List} object.
*/
public List getLessons(WebSession s, Category category, String role) { public List getLessons(WebSession s, Category category, String role) {
List<String> roles = new ArrayList<String>(); List<String> roles = new ArrayList<String>();
roles.add(role); roles.add(role);
return getLessons(s, category, roles); return getLessons(s, category, roles);
} }
/**
* <p>Getter for the field <code>lessons</code>.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param category a {@link org.owasp.webgoat.lessons.Category} object.
* @param roles a {@link java.util.List} object.
* @return a {@link java.util.List} object.
*/
public List<AbstractLesson> getLessons(WebSession s, Category category, List<String> roles) { public List<AbstractLesson> getLessons(WebSession s, Category category, List<String> roles) {
if (s.isHackedAdmin()) { if (s.isHackedAdmin()) {
roles.add(AbstractLesson.HACKED_ADMIN_ROLE); roles.add(AbstractLesson.HACKED_ADMIN_ROLE);
@ -279,6 +312,12 @@ public class Course {
return getLessons(category, roles); return getLessons(category, roles);
} }
/**
* <p>getLesson.</p>
*
* @param lessonId a int.
* @return a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
*/
public AbstractLesson getLesson(int lessonId) { public AbstractLesson getLesson(int lessonId) {
for (AbstractLesson l : lessons) { for (AbstractLesson l : lessons) {
if (l.getScreenId() == lessonId) { if (l.getScreenId() == lessonId) {
@ -326,7 +365,7 @@ public class Course {
/** /**
* Description of the Method * Description of the Method
* *
* @param webgoatContext * @param webgoatContext a {@link org.owasp.webgoat.session.WebgoatContext} object.
* @param path Description of the Parameter * @param path Description of the Parameter
* @param context Description of the Parameter * @param context Description of the Parameter
*/ */

6
webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java
View File

@ -7,7 +7,8 @@ import java.sql.Statement;
import org.owasp.webgoat.lessons.AbstractLesson; import org.owasp.webgoat.lessons.AbstractLesson;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -35,6 +36,7 @@ import org.owasp.webgoat.lessons.AbstractLesson;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @version $Id: $Id
*/ */
public class CreateDB public class CreateDB
{ {
@ -1010,9 +1012,9 @@ public class CreateDB
* *
* @param connection * @param connection
* Description of the Parameter * Description of the Parameter
*
* @exception SQLException * @exception SQLException
* Description of the Exception * Description of the Exception
* @throws java.sql.SQLException if any.
*/ */
public void makeDB(Connection connection) throws SQLException public void makeDB(Connection connection) throws SQLException
{ {

30
webgoat-container/src/main/java/org/owasp/webgoat/session/DatabaseUtilities.java
View File

@ -16,7 +16,8 @@ import org.apache.ecs.html.TR;
import org.apache.ecs.html.Table; import org.apache.ecs.html.Table;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -44,6 +45,7 @@ import org.apache.ecs.html.Table;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @version $Id: $Id
*/ */
public class DatabaseUtilities public class DatabaseUtilities
{ {
@ -51,11 +53,26 @@ public class DatabaseUtilities
private static Map<String, Connection> connections = new HashMap<String, Connection>(); private static Map<String, Connection> connections = new HashMap<String, Connection>();
private static Map<String, Boolean> dbBuilt = new HashMap<String, Boolean>(); private static Map<String, Boolean> dbBuilt = new HashMap<String, Boolean>();
/**
* <p>getConnection.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.sql.Connection} object.
* @throws java.sql.SQLException if any.
*/
public static Connection getConnection(WebSession s) throws SQLException public static Connection getConnection(WebSession s) throws SQLException
{ {
return getConnection(s.getUserName(), s.getWebgoatContext()); return getConnection(s.getUserName(), s.getWebgoatContext());
} }
/**
* <p>getConnection.</p>
*
* @param user a {@link java.lang.String} object.
* @param context a {@link org.owasp.webgoat.session.WebgoatContext} object.
* @return a {@link java.sql.Connection} object.
* @throws java.sql.SQLException if any.
*/
public static synchronized Connection getConnection(String user, WebgoatContext context) throws SQLException public static synchronized Connection getConnection(String user, WebgoatContext context) throws SQLException
{ {
Connection conn = connections.get(user); Connection conn = connections.get(user);
@ -72,6 +89,11 @@ public class DatabaseUtilities
return conn; return conn;
} }
/**
* <p>returnConnection.</p>
*
* @param user a {@link java.lang.String} object.
*/
public static synchronized void returnConnection(String user) public static synchronized void returnConnection(String user)
{ {
try try
@ -119,13 +141,15 @@ public class DatabaseUtilities
* Description of the Parameter * Description of the Parameter
* @param resultsMetaData * @param resultsMetaData
* Description of the Parameter * Description of the Parameter
* * @param resultsMetaData
* Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*
* @exception IOException * @exception IOException
* Description of the Exception * Description of the Exception
* @exception SQLException * @exception SQLException
* Description of the Exception * Description of the Exception
* @throws java.io.IOException if any.
* @throws java.sql.SQLException if any.
*/ */
public static MultiPartElement writeTable(ResultSet results, ResultSetMetaData resultsMetaData) throws IOException, public static MultiPartElement writeTable(ResultSet results, ResultSetMetaData resultsMetaData) throws IOException,
SQLException SQLException

38
webgoat-container/src/main/java/org/owasp/webgoat/session/ECSFactory.java
View File

@ -22,7 +22,8 @@ import org.apache.ecs.html.TR;
import org.apache.ecs.html.U; import org.apache.ecs.html.U;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -50,9 +51,9 @@ import org.apache.ecs.html.U;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams (jeff.williams@aspectsecurity.com) * @author Jeff Williams (jeff.williams@aspectsecurity.com)
* @created October 29, 2003 * @since October 29, 2003
* @version $Id: $Id
*/ */
public class ECSFactory public class ECSFactory
{ {
@ -85,7 +86,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static Element makeBox(String name, String value) public static Element makeBox(String name, String value)
{ {
@ -103,7 +103,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static Element makeButton(String text) public static Element makeButton(String text)
{ {
@ -116,6 +115,13 @@ public class ECSFactory
return (b); return (b);
} }
/**
* <p>makeButton.</p>
*
* @param text a {@link java.lang.String} object.
* @param onClickFunction a {@link java.lang.String} object.
* @return a {@link org.apache.ecs.Element} object.
*/
public static Element makeButton(String text, String onClickFunction) public static Element makeButton(String text, String onClickFunction)
{ {
@ -136,7 +142,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static TR makeField(String labeltext, String value, Element e) public static TR makeField(String labeltext, String value, Element e)
{ {
@ -172,7 +177,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static TR makeField(String labeltext, String name, String value, int size) public static TR makeField(String labeltext, String name, String value, int size)
{ {
@ -207,7 +211,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static Element makeInput(String label, String type, String name, boolean value, boolean selected, public static Element makeInput(String label, String type, String name, boolean value, boolean selected,
String alignment) String alignment)
{ {
@ -228,7 +231,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static Element makeInput(String label, String type, String name, String value) public static Element makeInput(String label, String type, String name, String value)
{ {
@ -252,7 +254,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static Element makeInput(String label, String type, String name, String value, boolean selected, public static Element makeInput(String label, String type, String name, String value, boolean selected,
String alignment) String alignment)
{ {
@ -298,7 +299,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static A makeLink(String text, String name, String value) public static A makeLink(String text, String name, String value)
{ {
@ -331,7 +331,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static A makeLink(String text, String name, int value) public static A makeLink(String text, String name, int value)
{ {
@ -349,7 +348,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static A makeLink(String text, String name, boolean value) public static A makeLink(String text, String name, boolean value)
{ {
@ -367,7 +365,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static Input makeOnClickInput(String text, String clickAction, String type) public static Input makeOnClickInput(String text, String clickAction, String type)
{ {
@ -393,7 +390,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static TR makeOption(String labeltext, String value, Element e) public static TR makeOption(String labeltext, String value, Element e)
{ {
@ -425,7 +421,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static Option makeOption(String label, boolean value) public static Option makeOption(String label, boolean value)
{ {
@ -474,7 +469,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static Element makePulldown(String name, List<String> options) public static Element makePulldown(String name, List<String> options)
{ {
@ -491,8 +485,8 @@ public class ECSFactory
* @param results * @param results
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
* @param name a {@link java.lang.String} object.
*/ */
public static Element makePulldown(String name, String results) public static Element makePulldown(String name, String results)
{ {
@ -531,7 +525,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static Select makePulldown(String name, Object[] list, String selected, int rowsShowing) public static Select makePulldown(String name, Object[] list, String selected, int rowsShowing)
{ {
@ -567,6 +560,8 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @param select * @param select
* Description of the Parameter * Description of the Parameter
* @param selected
* Description of the Parameter
* @param name * @param name
* Description of the Parameter * Description of the Parameter
* @param options * @param options
@ -577,7 +572,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static Element makeSelect(boolean diffNames, Select select, String name, Vector<Option> options, public static Element makeSelect(boolean diffNames, Select select, String name, Vector<Option> options,
String[] list, String selected) String[] list, String selected)
{ {
@ -592,6 +586,8 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @param select * @param select
* Description of the Parameter * Description of the Parameter
* @param selected
* Description of the Parameter
* @param name * @param name
* Description of the Parameter * Description of the Parameter
* @param options * @param options
@ -604,7 +600,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static Select makeSelect(boolean diffNames, Select select, String name, Vector<Option> options, public static Select makeSelect(boolean diffNames, Select select, String name, Vector<Option> options,
String[] list, String selected, int rowsShowing) String[] list, String selected, int rowsShowing)
{ {
@ -722,7 +717,6 @@ public class ECSFactory
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
*/ */
public static Element makeTextArea(String title, String text) public static Element makeTextArea(String title, String text)
{ {

166
webgoat-container/src/main/java/org/owasp/webgoat/session/Employee.java
View File

@ -4,7 +4,8 @@ package org.owasp.webgoat.session;
import java.io.Serializable; import java.io.Serializable;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -30,6 +31,8 @@ import java.io.Serializable;
* projects. * projects.
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
*
* @version $Id: $Id
*/ */
public class Employee implements Serializable public class Employee implements Serializable
{ {
@ -39,10 +42,13 @@ public class Employee implements Serializable
*/ */
private static final long serialVersionUID = -1901957360367218399L; private static final long serialVersionUID = -1901957360367218399L;
/** Constant <code>EMPLOYEE_ROLE="employee"</code> */
public final static String EMPLOYEE_ROLE = "employee"; public final static String EMPLOYEE_ROLE = "employee";
/** Constant <code>MANAGER_ROLE="manager"</code> */
public final static String MANAGER_ROLE = "manager"; public final static String MANAGER_ROLE = "manager";
/** Constant <code>HR_ROLE="hr"</code> */
public final static String HR_ROLE = "hr"; public final static String HR_ROLE = "hr";
private int id; private int id;
@ -78,10 +84,33 @@ public class Employee implements Serializable
private String personalDescription; private String personalDescription;
// FIXME: To be deleted // FIXME: To be deleted
/**
* <p>Constructor for Employee.</p>
*/
public Employee() public Employee()
{ {
} }
/**
* <p>Constructor for Employee.</p>
*
* @param id a int.
* @param firstName a {@link java.lang.String} object.
* @param lastName a {@link java.lang.String} object.
* @param ssn a {@link java.lang.String} object.
* @param title a {@link java.lang.String} object.
* @param phone a {@link java.lang.String} object.
* @param address1 a {@link java.lang.String} object.
* @param address2 a {@link java.lang.String} object.
* @param manager a int.
* @param startDate a {@link java.lang.String} object.
* @param salary a int.
* @param ccn a {@link java.lang.String} object.
* @param ccnLimit a int.
* @param disciplinaryActionDate a {@link java.lang.String} object.
* @param disciplinaryActionNotes a {@link java.lang.String} object.
* @param personalDescription a {@link java.lang.String} object.
*/
public Employee(int id, String firstName, String lastName, String ssn, String title, String phone, String address1, public Employee(int id, String firstName, String lastName, String ssn, String title, String phone, String address1,
String address2, int manager, String startDate, int salary, String ccn, int ccnLimit, String address2, int manager, String startDate, int salary, String ccn, int ccnLimit,
String disciplinaryActionDate, String disciplinaryActionNotes, String personalDescription) String disciplinaryActionDate, String disciplinaryActionNotes, String personalDescription)
@ -104,136 +133,271 @@ public class Employee implements Serializable
this.personalDescription = personalDescription; this.personalDescription = personalDescription;
} }
/**
* <p>Getter for the field <code>address1</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getAddress1() public String getAddress1()
{ {
return address1; return address1;
} }
/**
* <p>Setter for the field <code>address1</code>.</p>
*
* @param address1 a {@link java.lang.String} object.
*/
public void setAddress1(String address1) public void setAddress1(String address1)
{ {
this.address1 = address1; this.address1 = address1;
} }
/**
* <p>Getter for the field <code>address2</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getAddress2() public String getAddress2()
{ {
return address2; return address2;
} }
/**
* <p>Setter for the field <code>address2</code>.</p>
*
* @param address2 a {@link java.lang.String} object.
*/
public void setAddress2(String address2) public void setAddress2(String address2)
{ {
this.address2 = address2; this.address2 = address2;
} }
/**
* <p>Getter for the field <code>ccn</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getCcn() public String getCcn()
{ {
return ccn; return ccn;
} }
/**
* <p>Setter for the field <code>ccn</code>.</p>
*
* @param ccn a {@link java.lang.String} object.
*/
public void setCcn(String ccn) public void setCcn(String ccn)
{ {
this.ccn = ccn; this.ccn = ccn;
} }
/**
* <p>Getter for the field <code>ccnLimit</code>.</p>
*
* @return a int.
*/
public int getCcnLimit() public int getCcnLimit()
{ {
return ccnLimit; return ccnLimit;
} }
/**
* <p>Setter for the field <code>ccnLimit</code>.</p>
*
* @param ccnLimit a int.
*/
public void setCcnLimit(int ccnLimit) public void setCcnLimit(int ccnLimit)
{ {
this.ccnLimit = ccnLimit; this.ccnLimit = ccnLimit;
} }
/**
* <p>Getter for the field <code>firstName</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getFirstName() public String getFirstName()
{ {
return firstName; return firstName;
} }
/**
* <p>Setter for the field <code>firstName</code>.</p>
*
* @param firstName a {@link java.lang.String} object.
*/
public void setFirstName(String firstName) public void setFirstName(String firstName)
{ {
this.firstName = firstName; this.firstName = firstName;
} }
/**
* <p>Getter for the field <code>lastName</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getLastName() public String getLastName()
{ {
return lastName; return lastName;
} }
/**
* <p>Setter for the field <code>lastName</code>.</p>
*
* @param lastName a {@link java.lang.String} object.
*/
public void setLastName(String lastName) public void setLastName(String lastName)
{ {
this.lastName = lastName; this.lastName = lastName;
} }
/**
* <p>getPhoneNumber.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getPhoneNumber() public String getPhoneNumber()
{ {
return phone; return phone;
} }
/**
* <p>setPhoneNumber.</p>
*
* @param phone a {@link java.lang.String} object.
*/
public void setPhoneNumber(String phone) public void setPhoneNumber(String phone)
{ {
this.phone = phone; this.phone = phone;
} }
/**
* <p>Getter for the field <code>salary</code>.</p>
*
* @return a int.
*/
public int getSalary() public int getSalary()
{ {
return salary; return salary;
} }
/**
* <p>Setter for the field <code>salary</code>.</p>
*
* @param salary a int.
*/
public void setSalary(int salary) public void setSalary(int salary)
{ {
this.salary = salary; this.salary = salary;
} }
/**
* <p>Getter for the field <code>ssn</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getSsn() public String getSsn()
{ {
return ssn; return ssn;
} }
/**
* <p>Setter for the field <code>ssn</code>.</p>
*
* @param ssn a {@link java.lang.String} object.
*/
public void setSsn(String ssn) public void setSsn(String ssn)
{ {
this.ssn = ssn; this.ssn = ssn;
} }
/**
* <p>Getter for the field <code>startDate</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getStartDate() public String getStartDate()
{ {
return startDate; return startDate;
} }
/**
* <p>Setter for the field <code>startDate</code>.</p>
*
* @param startDate a {@link java.lang.String} object.
*/
public void setStartDate(String startDate) public void setStartDate(String startDate)
{ {
this.startDate = startDate; this.startDate = startDate;
} }
/**
* <p>Getter for the field <code>id</code>.</p>
*
* @return a int.
*/
public int getId() public int getId()
{ {
return id; return id;
} }
/**
* <p>Setter for the field <code>id</code>.</p>
*
* @param id a int.
*/
public void setId(int id) public void setId(int id)
{ {
this.id = id; this.id = id;
} }
/**
* <p>Getter for the field <code>title</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getTitle() public String getTitle()
{ {
return this.title; return this.title;
} }
/**
* <p>Getter for the field <code>manager</code>.</p>
*
* @return a int.
*/
public int getManager() public int getManager()
{ {
return this.manager; return this.manager;
} }
/**
* <p>Getter for the field <code>disciplinaryActionDate</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getDisciplinaryActionDate() public String getDisciplinaryActionDate()
{ {
return this.disciplinaryActionDate; return this.disciplinaryActionDate;
} }
/**
* <p>Getter for the field <code>disciplinaryActionNotes</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getDisciplinaryActionNotes() public String getDisciplinaryActionNotes()
{ {
return this.disciplinaryActionNotes; return this.disciplinaryActionNotes;
} }
/**
* <p>Getter for the field <code>personalDescription</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getPersonalDescription() public String getPersonalDescription()
{ {
return this.personalDescription; return this.personalDescription;

40
webgoat-container/src/main/java/org/owasp/webgoat/session/EmployeeStub.java
View File

@ -4,7 +4,8 @@ package org.owasp.webgoat.session;
import java.io.Serializable; import java.io.Serializable;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -30,6 +31,8 @@ import java.io.Serializable;
* projects. * projects.
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
*
* @version $Id: $Id
*/ */
public class EmployeeStub implements Serializable public class EmployeeStub implements Serializable
{ {
@ -47,11 +50,26 @@ public class EmployeeStub implements Serializable
private String role; private String role;
/**
* <p>Constructor for EmployeeStub.</p>
*
* @param id a int.
* @param firstName a {@link java.lang.String} object.
* @param lastName a {@link java.lang.String} object.
*/
public EmployeeStub(int id, String firstName, String lastName) public EmployeeStub(int id, String firstName, String lastName)
{ {
this(id, firstName, lastName, Employee.EMPLOYEE_ROLE); this(id, firstName, lastName, Employee.EMPLOYEE_ROLE);
} }
/**
* <p>Constructor for EmployeeStub.</p>
*
* @param id a int.
* @param firstName a {@link java.lang.String} object.
* @param lastName a {@link java.lang.String} object.
* @param role a {@link java.lang.String} object.
*/
public EmployeeStub(int id, String firstName, String lastName, String role) public EmployeeStub(int id, String firstName, String lastName, String role)
{ {
this.id = id; this.id = id;
@ -60,21 +78,41 @@ public class EmployeeStub implements Serializable
this.role = role; this.role = role;
} }
/**
* <p>Getter for the field <code>firstName</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getFirstName() public String getFirstName()
{ {
return firstName; return firstName;
} }
/**
* <p>Getter for the field <code>id</code>.</p>
*
* @return a int.
*/
public int getId() public int getId()
{ {
return id; return id;
} }
/**
* <p>Getter for the field <code>lastName</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getLastName() public String getLastName()
{ {
return lastName; return lastName;
} }
/**
* <p>Getter for the field <code>role</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getRole() public String getRole()
{ {
return role; return role;

33
webgoat-container/src/main/java/org/owasp/webgoat/session/ErrorScreen.java
View File

@ -19,7 +19,8 @@ import org.apache.ecs.html.TR;
import org.apache.ecs.html.Table; import org.apache.ecs.html.Table;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -47,7 +48,8 @@ import org.apache.ecs.html.Table;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @created November 4, 2003 * @since November 4, 2003
* @version $Id: $Id
*/ */
public class ErrorScreen extends Screen public class ErrorScreen extends Screen
{ {
@ -91,6 +93,11 @@ public class ErrorScreen extends Screen
setup(s); setup(s);
} }
/**
* <p>fixCurrentScreen.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
*/
public void fixCurrentScreen(WebSession s) public void fixCurrentScreen(WebSession s)
{ {
// So the user can't get stuck on the error screen, reset the // So the user can't get stuck on the error screen, reset the
@ -107,6 +114,11 @@ public class ErrorScreen extends Screen
} }
} }
/**
* <p>setup.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
*/
public void setup(WebSession s) public void setup(WebSession s)
{ {
// call createContent first so messages will go somewhere // call createContent first so messages will go somewhere
@ -124,6 +136,12 @@ public class ErrorScreen extends Screen
setContent(layout); setContent(layout);
} }
/**
* <p>wrapForm.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link org.apache.ecs.Element} object.
*/
protected Element wrapForm(WebSession s) protected Element wrapForm(WebSession s)
{ {
if (s == null) { return new StringElement("Invalid Session"); } if (s == null) { return new StringElement("Invalid Session"); }
@ -140,11 +158,9 @@ public class ErrorScreen extends Screen
} }
/** /**
* Description of the Method * {@inheritDoc}
* *
* @param s * Description of the Method
* Description of the Parameter
* @return Description of the Return Value
*/ */
protected Element createContent(WebSession s) protected Element createContent(WebSession s)
{ {
@ -257,6 +273,11 @@ public class ErrorScreen extends Screen
return ("Error"); return ("Error");
} }
/**
* <p>getRole.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getRole() public String getRole()
{ {
return AbstractLesson.USER_ROLE; return AbstractLesson.USER_ROLE;

26
webgoat-container/src/main/java/org/owasp/webgoat/session/LessonSession.java
View File

@ -1,7 +1,8 @@
package org.owasp.webgoat.session; package org.owasp.webgoat.session;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -31,7 +32,8 @@ package org.owasp.webgoat.session;
* Represents a virtual session for a lesson. Lesson-specific session data may be stored here. * Represents a virtual session for a lesson. Lesson-specific session data may be stored here.
* *
* @author David Anderson <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author David Anderson <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @created January 19, 2006 * @since January 19, 2006
* @version $Id: $Id
*/ */
public class LessonSession public class LessonSession
{ {
@ -40,21 +42,41 @@ public class LessonSession
private String currentLessonScreen; private String currentLessonScreen;
/**
* <p>setAuthenticated.</p>
*
* @param isAuthenticated a boolean.
*/
public void setAuthenticated(boolean isAuthenticated) public void setAuthenticated(boolean isAuthenticated)
{ {
this.isAuthenticated = isAuthenticated; this.isAuthenticated = isAuthenticated;
} }
/**
* <p>isAuthenticated.</p>
*
* @return a boolean.
*/
public boolean isAuthenticated() public boolean isAuthenticated()
{ {
return this.isAuthenticated; return this.isAuthenticated;
} }
/**
* <p>Setter for the field <code>currentLessonScreen</code>.</p>
*
* @param currentLessonScreen a {@link java.lang.String} object.
*/
public void setCurrentLessonScreen(String currentLessonScreen) public void setCurrentLessonScreen(String currentLessonScreen)
{ {
this.currentLessonScreen = currentLessonScreen; this.currentLessonScreen = currentLessonScreen;
} }
/**
* <p>Getter for the field <code>currentLessonScreen</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getCurrentLessonScreen() public String getCurrentLessonScreen()
{ {
return this.currentLessonScreen; return this.currentLessonScreen;

31
webgoat-container/src/main/java/org/owasp/webgoat/session/LessonTracker.java
View File

@ -7,7 +7,8 @@ import java.io.FileOutputStream;
import java.util.Properties; import java.util.Properties;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -35,7 +36,8 @@ import java.util.Properties;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 29, 2003 * @since October 29, 2003
* @version $Id: $Id
*/ */
public class LessonTracker public class LessonTracker
{ {
@ -140,6 +142,11 @@ public class LessonTracker
return viewedSource; return viewedSource;
} }
/**
* <p>Getter for the field <code>viewedSolution</code>.</p>
*
* @return a boolean.
*/
public boolean getViewedSolution() public boolean getViewedSolution()
{ {
return viewedSource; return viewedSource;
@ -158,6 +165,7 @@ public class LessonTracker
* *
* @param props * @param props
* The new properties value * The new properties value
* @param screen a {@link org.owasp.webgoat.session.Screen} object.
*/ */
protected void setProperties(Properties props, Screen screen) protected void setProperties(Properties props, Screen screen)
{ {
@ -171,6 +179,12 @@ public class LessonTracker
viewedSource = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedSource", "false")).booleanValue(); viewedSource = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedSource", "false")).booleanValue();
} }
/**
* <p>getUserDir.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.lang.String} object.
*/
public static String getUserDir(WebSession s) public static String getUserDir(WebSession s)
{ {
return s.getContext().getRealPath("users") + "/"; return s.getContext().getRealPath("users") + "/";
@ -186,9 +200,12 @@ public class LessonTracker
* *
* @param screen * @param screen
* Description of the Parameter * Description of the Parameter
* @param screen
* Description of the Parameter
* @param s * @param s
* Description of the Parameter * Description of the Parameter
* @return Description of the Return Value * @return Description of the Return Value
* @param user a {@link java.lang.String} object.
*/ */
public static LessonTracker load(WebSession s, String user, Screen screen) public static LessonTracker load(WebSession s, String user, Screen screen)
{ {
@ -307,8 +324,7 @@ public class LessonTracker
/** /**
* Sets the viewedSource attribute of the LessonTracker object * Sets the viewedSource attribute of the LessonTracker object
* *
* @param viewedSource * @param viewedSolution a boolean.
* The new viewedSource value
*/ */
public void setViewedSolution(boolean viewedSolution) public void setViewedSolution(boolean viewedSolution)
{ {
@ -320,6 +336,7 @@ public class LessonTracker
* *
* @param s * @param s
* Description of the Parameter * Description of the Parameter
* @param screen a {@link org.owasp.webgoat.session.Screen} object.
*/ */
public void store(WebSession s, Screen screen) public void store(WebSession s, Screen screen)
{ {
@ -331,6 +348,8 @@ public class LessonTracker
* *
* @param s * @param s
* Description of the Parameter * Description of the Parameter
* @param screen a {@link org.owasp.webgoat.session.Screen} object.
* @param user a {@link java.lang.String} object.
*/ */
public void store(WebSession s, Screen screen, String user) public void store(WebSession s, Screen screen, String user)
{ {
@ -386,6 +405,8 @@ public class LessonTracker
} }
/** /**
* <p>Getter for the field <code>lessonProperties</code>.</p>
*
* @return Returns the lessonProperties. * @return Returns the lessonProperties.
*/ */
public Properties getLessonProperties() public Properties getLessonProperties()
@ -394,6 +415,8 @@ public class LessonTracker
} }
/** /**
* <p>Setter for the field <code>lessonProperties</code>.</p>
*
* @param lessonProperties * @param lessonProperties
* The lessonProperties to set. * The lessonProperties to set.
*/ */

33
webgoat-container/src/main/java/org/owasp/webgoat/session/Parameter.java
View File

@ -1,7 +1,8 @@
package org.owasp.webgoat.session; package org.owasp.webgoat.session;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -27,6 +28,8 @@ package org.owasp.webgoat.session;
* projects. * projects.
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
*
* @version $Id: $Id
*/ */
public class Parameter implements Comparable public class Parameter implements Comparable
{ {
@ -35,23 +38,40 @@ public class Parameter implements Comparable
String value; String value;
/**
* <p>Constructor for Parameter.</p>
*
* @param name a {@link java.lang.String} object.
* @param value a {@link java.lang.String} object.
*/
public Parameter(String name, String value) public Parameter(String name, String value)
{ {
this.name = name; this.name = name;
this.value = value; this.value = value;
} }
/**
* <p>Getter for the field <code>name</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getName() public String getName()
{ {
return name; return name;
} }
/**
* <p>Getter for the field <code>value</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getValue() public String getValue()
{ {
return value; return value;
} }
// @Override // @Override
/** {@inheritDoc} */
public boolean equals(Object obj) public boolean equals(Object obj)
{ {
if (obj instanceof Parameter) if (obj instanceof Parameter)
@ -63,17 +83,28 @@ public class Parameter implements Comparable
} }
// @Override // @Override
/**
* <p>hashCode.</p>
*
* @return a int.
*/
public int hashCode() public int hashCode()
{ {
return toString().hashCode(); return toString().hashCode();
} }
// @Override // @Override
/**
* <p>toString.</p>
*
* @return a {@link java.lang.String} object.
*/
public String toString() public String toString()
{ {
return (name + "=" + value); return (name + "=" + value);
} }
/** {@inheritDoc} */
public int compareTo(Object o) public int compareTo(Object o)
{ {
return toString().compareTo(o.toString()); return toString().compareTo(o.toString());

4
webgoat-container/src/main/java/org/owasp/webgoat/session/ParameterNotFoundException.java
View File

@ -1,7 +1,8 @@
package org.owasp.webgoat.session; package org.owasp.webgoat.session;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -29,6 +30,7 @@ package org.owasp.webgoat.session;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @version $Id: $Id
*/ */
public class ParameterNotFoundException extends Exception public class ParameterNotFoundException extends Exception
{ {

146
webgoat-container/src/main/java/org/owasp/webgoat/session/ParameterParser.java
View File

@ -37,8 +37,8 @@ import org.owasp.webgoat.util.HtmlEncoder;
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* Security</a> * @version $Id: $Id
*/ */
public class ParameterParser { public class ParameterParser {
@ -87,6 +87,7 @@ public class ParameterParser {
* @param name the parameter name * @param name the parameter name
* @return the parameter value as a boolean * @return the parameter value as a boolean
* @exception ParameterNotFoundException if the parameter was not found * @exception ParameterNotFoundException if the parameter was not found
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
*/ */
public boolean getBooleanParameter(String name) throws ParameterNotFoundException { public boolean getBooleanParameter(String name) throws ParameterNotFoundException {
return new Boolean(getStringParameter(name)).booleanValue(); return new Boolean(getStringParameter(name)).booleanValue();
@ -132,6 +133,8 @@ public class ParameterParser {
* @exception ParameterNotFoundException if the parameter was not found * @exception ParameterNotFoundException if the parameter was not found
* @exception NumberFormatException if the parameter value could not be * @exception NumberFormatException if the parameter value could not be
* converted to a byte * converted to a byte
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws java.lang.NumberFormatException if any.
*/ */
public byte getByteParameter(String name) throws ParameterNotFoundException, NumberFormatException { public byte getByteParameter(String name) throws ParameterNotFoundException, NumberFormatException {
return Byte.parseByte(getStringParameter(name)); return Byte.parseByte(getStringParameter(name));
@ -161,6 +164,7 @@ public class ParameterParser {
* @return the parameter value as a char * @return the parameter value as a char
* @exception ParameterNotFoundException if the parameter was not found or * @exception ParameterNotFoundException if the parameter was not found or
* was the empty string * was the empty string
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
*/ */
public char getCharParameter(String name) throws ParameterNotFoundException { public char getCharParameter(String name) throws ParameterNotFoundException {
String param = getStringParameter(name); String param = getStringParameter(name);
@ -193,6 +197,7 @@ public class ParameterParser {
* *
* @param name Description of the Parameter * @param name Description of the Parameter
* @return The classNameParameter value * @return The classNameParameter value
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
*/ */
public String getClassNameParameter(String name) throws ParameterNotFoundException { public String getClassNameParameter(String name) throws ParameterNotFoundException {
String p = getStringParameter(name); String p = getStringParameter(name);
@ -225,6 +230,8 @@ public class ParameterParser {
* @exception ParameterNotFoundException if the parameter was not found * @exception ParameterNotFoundException if the parameter was not found
* @exception NumberFormatException if the parameter could not be converted * @exception NumberFormatException if the parameter could not be converted
* to a double * to a double
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws java.lang.NumberFormatException if any.
*/ */
public double getDoubleParameter(String name) throws ParameterNotFoundException, NumberFormatException { public double getDoubleParameter(String name) throws ParameterNotFoundException, NumberFormatException {
return new Double(getStringParameter(name)).doubleValue(); return new Double(getStringParameter(name)).doubleValue();
@ -254,6 +261,8 @@ public class ParameterParser {
* @exception ParameterNotFoundException if the parameter was not found * @exception ParameterNotFoundException if the parameter was not found
* @exception NumberFormatException if the parameter could not be converted * @exception NumberFormatException if the parameter could not be converted
* to a float * to a float
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws java.lang.NumberFormatException if any.
*/ */
public float getFloatParameter(String name) throws ParameterNotFoundException, NumberFormatException { public float getFloatParameter(String name) throws ParameterNotFoundException, NumberFormatException {
return new Float(getStringParameter(name)).floatValue(); return new Float(getStringParameter(name)).floatValue();
@ -299,6 +308,7 @@ public class ParameterParser {
* invalid * invalid
* @exception ParameterNotFoundException if the parameter was not found or * @exception ParameterNotFoundException if the parameter was not found or
* was the empty string * was the empty string
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
*/ */
public String getIPParameter(String name) throws ParameterNotFoundException { public String getIPParameter(String name) throws ParameterNotFoundException {
boolean valid = true; boolean valid = true;
@ -372,6 +382,8 @@ public class ParameterParser {
* @exception ParameterNotFoundException if the parameter was not found * @exception ParameterNotFoundException if the parameter was not found
* @exception NumberFormatException if the parameter could not be converted * @exception NumberFormatException if the parameter could not be converted
* to a int * to a int
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws java.lang.NumberFormatException if any.
*/ */
public int getIntParameter(String name) throws ParameterNotFoundException, NumberFormatException { public int getIntParameter(String name) throws ParameterNotFoundException, NumberFormatException {
return Integer.parseInt(getStringParameter(name)); return Integer.parseInt(getStringParameter(name));
@ -401,6 +413,8 @@ public class ParameterParser {
* @exception ParameterNotFoundException if the parameter was not found * @exception ParameterNotFoundException if the parameter was not found
* @exception NumberFormatException if the parameter could not be converted * @exception NumberFormatException if the parameter could not be converted
* to a long * to a long
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws java.lang.NumberFormatException if any.
*/ */
public long getLongParameter(String name) throws ParameterNotFoundException, NumberFormatException { public long getLongParameter(String name) throws ParameterNotFoundException, NumberFormatException {
return Long.parseLong(getStringParameter(name)); return Long.parseLong(getStringParameter(name));
@ -498,6 +512,7 @@ public class ParameterParser {
* @param name Description of the Parameter * @param name Description of the Parameter
* @return The rawParameter value * @return The rawParameter value
* @exception ParameterNotFoundException Description of the Exception * @exception ParameterNotFoundException Description of the Exception
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
*/ */
public String getRawParameter(String name) throws ParameterNotFoundException { public String getRawParameter(String name) throws ParameterNotFoundException {
String[] values = request.getParameterValues(name); String[] values = request.getParameterValues(name);
@ -519,6 +534,8 @@ public class ParameterParser {
* @exception ParameterNotFoundException if the parameter was not found * @exception ParameterNotFoundException if the parameter was not found
* @exception NumberFormatException if the parameter could not be converted * @exception NumberFormatException if the parameter could not be converted
* to a short * to a short
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws java.lang.NumberFormatException if any.
*/ */
public short getShortParameter(String name) throws ParameterNotFoundException, NumberFormatException { public short getShortParameter(String name) throws ParameterNotFoundException, NumberFormatException {
return Short.parseShort(getStringParameter(name)); return Short.parseShort(getStringParameter(name));
@ -547,6 +564,7 @@ public class ParameterParser {
* @return the parameter value as a String * @return the parameter value as a String
* @exception ParameterNotFoundException if the parameter was not found or * @exception ParameterNotFoundException if the parameter was not found or
* was the empty string * was the empty string
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
*/ */
public String getStringParameter(String name) throws ParameterNotFoundException { public String getStringParameter(String name) throws ParameterNotFoundException {
String[] values = request.getParameterValues(name); String[] values = request.getParameterValues(name);
@ -603,12 +621,13 @@ public class ParameterParser {
/** /**
* Gets the parameter named 'next' following the parameter 'first'. Presumes * Gets the parameter named 'next' following the parameter 'first'. Presumes
* the structure: first=firstvalue&next=nextValue * the structure: first=firstvalue&amp;next=nextValue
* *
* @param first Description of the Parameter * @param first Description of the Parameter
* @param next Description of the Parameter * @param next Description of the Parameter
* @return The subParameter value * @return The subParameter value
* @exception ParameterNotFoundException Description of the Exception * @exception ParameterNotFoundException Description of the Exception
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
*/ */
public String getSubParameter(String first, String next) throws ParameterNotFoundException { public String getSubParameter(String first, String next) throws ParameterNotFoundException {
String[] values = request.getParameterValues(first); String[] values = request.getParameterValues(first);
@ -664,6 +683,7 @@ public class ParameterParser {
* *
* @param name Description of the Parameter * @param name Description of the Parameter
* @return The wordParameter value * @return The wordParameter value
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
*/ */
public String getWordParameter(String name) throws ParameterNotFoundException { public String getWordParameter(String name) throws ParameterNotFoundException {
String p = getStringParameter(name); String p = getStringParameter(name);
@ -734,6 +754,15 @@ public class ParameterParser {
} }
} }
/**
* <p>getStrictAlphaParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @param maxLength a int.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getStrictAlphaParameter(String name, int maxLength) throws ParameterNotFoundException, public String getStrictAlphaParameter(String name, int maxLength) throws ParameterNotFoundException,
ValidationException { ValidationException {
String alphaRegEx = "^[a-zA-Z\\s]{0," + maxLength + "}$"; String alphaRegEx = "^[a-zA-Z\\s]{0," + maxLength + "}$";
@ -742,6 +771,15 @@ public class ParameterParser {
return getRegexParameter(name, alphaPattern); return getRegexParameter(name, alphaPattern);
} }
/**
* <p>getStrictNumericParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @param maxLength a int.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getStrictNumericParameter(String name, int maxLength) throws ParameterNotFoundException, public String getStrictNumericParameter(String name, int maxLength) throws ParameterNotFoundException,
ValidationException { ValidationException {
String numericRegEx = "^\\d{0," + maxLength + "}$"; String numericRegEx = "^\\d{0," + maxLength + "}$";
@ -754,6 +792,14 @@ public class ParameterParser {
private static final Pattern Ssnpattern = Pattern.compile(SSNREGEX); private static final Pattern Ssnpattern = Pattern.compile(SSNREGEX);
/**
* <p>getSsnParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getSsnParameter(String name) throws ParameterNotFoundException, ValidationException { public String getSsnParameter(String name) throws ParameterNotFoundException, ValidationException {
return getRegexParameter(name, Ssnpattern); return getRegexParameter(name, Ssnpattern);
} }
@ -767,6 +813,14 @@ public class ParameterParser {
private static final Pattern Ccnpattern = Pattern.compile(CCNREGEX); private static final Pattern Ccnpattern = Pattern.compile(CCNREGEX);
/**
* <p>getCcnParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getCcnParameter(String name) throws ParameterNotFoundException, ValidationException { public String getCcnParameter(String name) throws ParameterNotFoundException, ValidationException {
return getRegexParameter(name, Ccnpattern); return getRegexParameter(name, Ccnpattern);
} }
@ -775,10 +829,26 @@ public class ParameterParser {
private static final Pattern Zippattern = Pattern.compile(ZIPREGEX); private static final Pattern Zippattern = Pattern.compile(ZIPREGEX);
/**
* <p>getZipParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getZipParameter(String name) throws ParameterNotFoundException, ValidationException { public String getZipParameter(String name) throws ParameterNotFoundException, ValidationException {
return getZipParameter(name, null); return getZipParameter(name, null);
} }
/**
* <p>getZipParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @param def a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getZipParameter(String name, String def) throws ValidationException { public String getZipParameter(String name, String def) throws ValidationException {
return getRegexParameter(name, def, Zippattern); return getRegexParameter(name, def, Zippattern);
} }
@ -789,10 +859,26 @@ public class ParameterParser {
// private static final String PHONEREGEX = "^([\\-()+ 0-9x])+$"; // private static final String PHONEREGEX = "^([\\-()+ 0-9x])+$";
private static final Pattern phonepattern = Pattern.compile(PHONEREGEX); private static final Pattern phonepattern = Pattern.compile(PHONEREGEX);
/**
* <p>getPhoneParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getPhoneParameter(String name) throws ParameterNotFoundException, ValidationException { public String getPhoneParameter(String name) throws ParameterNotFoundException, ValidationException {
return getPhoneParameter(name, null); return getPhoneParameter(name, null);
} }
/**
* <p>getPhoneParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @param def a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getPhoneParameter(String name, String def) throws ValidationException { public String getPhoneParameter(String name, String def) throws ValidationException {
return getRegexParameter(name, def, phonepattern); return getRegexParameter(name, def, phonepattern);
} }
@ -801,10 +887,26 @@ public class ParameterParser {
private static final Pattern emailpattern = Pattern.compile(EMAILREGEX); private static final Pattern emailpattern = Pattern.compile(EMAILREGEX);
/**
* <p>getEMailParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getEMailParameter(String name) throws ParameterNotFoundException, ValidationException { public String getEMailParameter(String name) throws ParameterNotFoundException, ValidationException {
return getEMailParameter(name, null); return getEMailParameter(name, null);
} }
/**
* <p>getEMailParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @param def a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getEMailParameter(String name, String def) throws ValidationException { public String getEMailParameter(String name, String def) throws ValidationException {
return getRegexParameter(name, def, emailpattern); return getRegexParameter(name, def, emailpattern);
} }
@ -813,10 +915,26 @@ public class ParameterParser {
private static final Pattern datepattern = Pattern.compile(DATEREGEX); private static final Pattern datepattern = Pattern.compile(DATEREGEX);
/**
* <p>getDateParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getDateParameter(String name) throws ParameterNotFoundException, ValidationException { public String getDateParameter(String name) throws ParameterNotFoundException, ValidationException {
return getDateParameter(name, null); return getDateParameter(name, null);
} }
/**
* <p>getDateParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @param def a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getDateParameter(String name, String def) throws ValidationException { public String getDateParameter(String name, String def) throws ValidationException {
return getRegexParameter(name, def, datepattern); return getRegexParameter(name, def, datepattern);
} }
@ -825,14 +943,36 @@ public class ParameterParser {
private static final Pattern URLpattern = Pattern.compile(URLREGEX); private static final Pattern URLpattern = Pattern.compile(URLREGEX);
/**
* <p>getURLParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getURLParameter(String name) throws ParameterNotFoundException, ValidationException { public String getURLParameter(String name) throws ParameterNotFoundException, ValidationException {
return getURLParameter(name, null); return getURLParameter(name, null);
} }
/**
* <p>getURLParameter.</p>
*
* @param name a {@link java.lang.String} object.
* @param def a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ValidationException if any.
*/
public String getURLParameter(String name, String def) throws ValidationException { public String getURLParameter(String name, String def) throws ValidationException {
return getRegexParameter(name, def, URLpattern); return getRegexParameter(name, def, URLpattern);
} }
/**
* <p>htmlEncode.</p>
*
* @param s a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
*/
protected static String htmlEncode(String s) { protected static String htmlEncode(String s) {
return HtmlEncoder.encode(s); return HtmlEncoder.encode(s);
} }

47
webgoat-container/src/main/java/org/owasp/webgoat/session/RandomLessonTracker.java
View File

@ -6,6 +6,11 @@ import java.util.Map;
import java.util.Properties; import java.util.Properties;
/**
* <p>RandomLessonTracker class.</p>
*
* @version $Id: $Id
*/
public class RandomLessonTracker extends LessonTracker public class RandomLessonTracker extends LessonTracker
{ {
@ -15,23 +20,44 @@ public class RandomLessonTracker extends LessonTracker
private Map<String, Boolean> completed = new HashMap<String, Boolean>(); private Map<String, Boolean> completed = new HashMap<String, Boolean>();
/**
* <p>Constructor for RandomLessonTracker.</p>
*
* @param stages an array of {@link java.lang.String} objects.
*/
public RandomLessonTracker(String[] stages) public RandomLessonTracker(String[] stages)
{ {
if (stages == null) stages = new String[0]; if (stages == null) stages = new String[0];
this.stages = stages; this.stages = stages;
} }
/**
* <p>Setter for the field <code>stage</code>.</p>
*
* @param stage a {@link java.lang.String} object.
*/
public void setStage(String stage) public void setStage(String stage)
{ {
this.stage = stage; this.stage = stage;
} }
/**
* <p>Getter for the field <code>stage</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getStage() public String getStage()
{ {
if (this.stage == null && stages.length > 0) return stages[0]; if (this.stage == null && stages.length > 0) return stages[0];
return this.stage; return this.stage;
} }
/**
* <p>setStageComplete.</p>
*
* @param stage a {@link java.lang.String} object.
* @param complete a boolean.
*/
public void setStageComplete(String stage, boolean complete) public void setStageComplete(String stage, boolean complete)
{ {
completed.put(stage, Boolean.valueOf(complete)); completed.put(stage, Boolean.valueOf(complete));
@ -40,6 +66,12 @@ public class RandomLessonTracker extends LessonTracker
if (i < stages.length - 1) setStage(stages[i + 1]); if (i < stages.length - 1) setStage(stages[i + 1]);
} }
/**
* <p>getStageNumber.</p>
*
* @param stage a {@link java.lang.String} object.
* @return a int.
*/
public int getStageNumber(String stage) public int getStageNumber(String stage)
{ {
for (int i = 0; i < stages.length; i++) for (int i = 0; i < stages.length; i++)
@ -47,12 +79,19 @@ public class RandomLessonTracker extends LessonTracker
return -1; return -1;
} }
/**
* <p>hasCompleted.</p>
*
* @param stage a {@link java.lang.String} object.
* @return a boolean.
*/
public boolean hasCompleted(String stage) public boolean hasCompleted(String stage)
{ {
Boolean complete = completed.get(stage); Boolean complete = completed.get(stage);
return complete == null ? false : complete.booleanValue(); return complete == null ? false : complete.booleanValue();
} }
/** {@inheritDoc} */
@Override @Override
public boolean getCompleted() public boolean getCompleted()
{ {
@ -61,6 +100,7 @@ public class RandomLessonTracker extends LessonTracker
return true; return true;
} }
/** {@inheritDoc} */
@Override @Override
public void setCompleted(boolean complete) public void setCompleted(boolean complete)
{ {
@ -70,6 +110,7 @@ public class RandomLessonTracker extends LessonTracker
setStage(stages[0]); setStage(stages[0]);
} }
/** {@inheritDoc} */
protected void setProperties(Properties props, Screen screen) protected void setProperties(Properties props, Screen screen)
{ {
super.setProperties(props, screen); super.setProperties(props, screen);
@ -84,6 +125,7 @@ public class RandomLessonTracker extends LessonTracker
setStage(props.getProperty(screen.getTitle() + ".stage")); setStage(props.getProperty(screen.getTitle() + ".stage"));
} }
/** {@inheritDoc} */
public void store(WebSession s, Screen screen, String user) public void store(WebSession s, Screen screen, String user)
{ {
for (int i = 0; i < stages.length; i++) for (int i = 0; i < stages.length; i++)
@ -102,6 +144,11 @@ public class RandomLessonTracker extends LessonTracker
super.store(s, screen, user); super.store(s, screen, user);
} }
/**
* <p>toString.</p>
*
* @return a {@link java.lang.String} object.
*/
public String toString() public String toString()
{ {
StringBuffer buff = new StringBuffer(); StringBuffer buff = new StringBuffer();

15
webgoat-container/src/main/java/org/owasp/webgoat/session/Role.java
View File

@ -1,12 +1,27 @@
package org.owasp.webgoat.session; package org.owasp.webgoat.session;
/**
* <p>Role class.</p>
*
* @version $Id: $Id
*/
public class Role { public class Role {
private String rolename; private String rolename;
/**
* <p>Constructor for Role.</p>
*
* @param rolename a {@link java.lang.String} object.
*/
public Role(String rolename) { public Role(String rolename) {
this.rolename = rolename; this.rolename = rolename;
} }
/**
* <p>Getter for the field <code>rolename</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getRolename() { public String getRolename() {
return this.rolename; return this.rolename;
} }

45
webgoat-container/src/main/java/org/owasp/webgoat/session/Screen.java
View File

@ -42,7 +42,8 @@ import org.owasp.webgoat.lessons.AbstractLesson;
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect
* Security</a> * Security</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public abstract class Screen { public abstract class Screen {
@ -69,6 +70,11 @@ public abstract class Screen {
// will be stored in the internal database. The user will be able to hack // will be stored in the internal database. The user will be able to hack
// into the database and change their role. This will allow the user to // into the database and change their role. This will allow the user to
// see the admin screens, once they figure out how to turn the admin switch on. // see the admin screens, once they figure out how to turn the admin switch on.
/**
* <p>getRole.</p>
*
* @return a {@link java.lang.String} object.
*/
public abstract String getRole(); public abstract String getRole();
/** /**
@ -106,19 +112,33 @@ public abstract class Screen {
/** /**
* Gets the lessonTracker attribute of the AbstractLesson object * Gets the lessonTracker attribute of the AbstractLesson object
* *
* @param userName Description of the Parameter
* @return The lessonTracker value * @return The lessonTracker value
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
*/ */
public LessonTracker getLessonTracker(WebSession s) { public LessonTracker getLessonTracker(WebSession s) {
UserTracker userTracker = UserTracker.instance(); UserTracker userTracker = UserTracker.instance();
return userTracker.getLessonTracker(s, this); return userTracker.getLessonTracker(s, this);
} }
/**
* <p>getLessonTracker.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param userNameOverride a {@link java.lang.String} object.
* @return a {@link org.owasp.webgoat.session.LessonTracker} object.
*/
public LessonTracker getLessonTracker(WebSession s, String userNameOverride) { public LessonTracker getLessonTracker(WebSession s, String userNameOverride) {
UserTracker userTracker = UserTracker.instance(); UserTracker userTracker = UserTracker.instance();
return userTracker.getLessonTracker(s, userNameOverride, this); return userTracker.getLessonTracker(s, userNameOverride, this);
} }
/**
* <p>getLessonTracker.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param lesson a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
* @return a {@link org.owasp.webgoat.session.LessonTracker} object.
*/
public LessonTracker getLessonTracker(WebSession s, AbstractLesson lesson) { public LessonTracker getLessonTracker(WebSession s, AbstractLesson lesson) {
UserTracker userTracker = UserTracker.instance(); UserTracker userTracker = UserTracker.instance();
return userTracker.getLessonTracker(s, lesson); return userTracker.getLessonTracker(s, lesson);
@ -131,6 +151,11 @@ public abstract class Screen {
*/ */
public abstract String getTitle(); public abstract String getTitle();
/**
* <p>Setter for the field <code>content</code>.</p>
*
* @param content a {@link org.apache.ecs.Element} object.
*/
protected void setContent(Element content) { protected void setContent(Element content) {
this.content = content; this.content = content;
} }
@ -145,10 +170,20 @@ public abstract class Screen {
return new A("http://www.aspectsecurity.com/webgoat.html", logo); return new A("http://www.aspectsecurity.com/webgoat.html", logo);
} }
/**
* <p>getSponsor.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getSponsor() { public String getSponsor() {
return "Aspect Security"; return "Aspect Security";
} }
/**
* <p>getSponsorLogoResource.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getSponsorLogoResource() { public String getSponsorLogoResource() {
return "images/aspectlogo-horizontal-small.jpg"; return "images/aspectlogo-horizontal-small.jpg";
} }
@ -178,6 +213,7 @@ public abstract class Screen {
/** /**
* Returns the content length of the the html. * Returns the content length of the the html.
* *
* @return a int.
*/ */
public int getContentLength() { public int getContentLength() {
return getContent().length(); return getContent().length();
@ -197,6 +233,11 @@ public abstract class Screen {
} }
// hook all the links // hook all the links
/**
* <p>Getter for the field <code>content</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getContent() { public String getContent() {
//String makeAllAjax = "<script>goat.utils.makeFormsAjax();goat.utils.ajaxifyAttackHref();</script>"; //String makeAllAjax = "<script>goat.utils.makeFormsAjax();goat.utils.ajaxifyAttackHref();</script>";
// need to do this here as some of the lessons render forms after submission of an ajax form // need to do this here as some of the lessons render forms after submission of an ajax form

22
webgoat-container/src/main/java/org/owasp/webgoat/session/SequentialLessonTracker.java
View File

@ -4,33 +4,55 @@ package org.owasp.webgoat.session;
import java.util.Properties; import java.util.Properties;
/**
* <p>SequentialLessonTracker class.</p>
*
* @version $Id: $Id
*/
public class SequentialLessonTracker extends LessonTracker public class SequentialLessonTracker extends LessonTracker
{ {
private int currentStage = 1; private int currentStage = 1;
/**
* <p>getStage.</p>
*
* @return a int.
*/
public int getStage() public int getStage()
{ {
return currentStage; return currentStage;
} }
/**
* <p>setStage.</p>
*
* @param stage a int.
*/
public void setStage(int stage) public void setStage(int stage)
{ {
currentStage = stage; currentStage = stage;
} }
/** {@inheritDoc} */
protected void setProperties(Properties props, Screen screen) protected void setProperties(Properties props, Screen screen)
{ {
super.setProperties(props, screen); super.setProperties(props, screen);
currentStage = Integer.parseInt(props.getProperty(screen.getTitle() + ".currentStage")); currentStage = Integer.parseInt(props.getProperty(screen.getTitle() + ".currentStage"));
} }
/** {@inheritDoc} */
public void store(WebSession s, Screen screen, String user) public void store(WebSession s, Screen screen, String user)
{ {
lessonProperties.setProperty(screen.getTitle() + ".currentStage", Integer.toString(currentStage)); lessonProperties.setProperty(screen.getTitle() + ".currentStage", Integer.toString(currentStage));
super.store(s, screen, user); super.store(s, screen, user);
} }
/**
* <p>toString.</p>
*
* @return a {@link java.lang.String} object.
*/
public String toString() public String toString()
{ {
return super.toString() + " - currentStage:....... " + currentStage + "\n"; return super.toString() + " - currentStage:....... " + currentStage + "\n";

5
webgoat-container/src/main/java/org/owasp/webgoat/session/UnauthenticatedException.java
View File

@ -1,7 +1,8 @@
package org.owasp.webgoat.session; package org.owasp.webgoat.session;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -27,6 +28,8 @@ package org.owasp.webgoat.session;
* projects. * projects.
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
*
* @version $Id: $Id
*/ */
public class UnauthenticatedException extends Exception public class UnauthenticatedException extends Exception
{ {

5
webgoat-container/src/main/java/org/owasp/webgoat/session/UnauthorizedException.java
View File

@ -1,7 +1,8 @@
package org.owasp.webgoat.session; package org.owasp.webgoat.session;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -27,6 +28,8 @@ package org.owasp.webgoat.session;
* projects. * projects.
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
*
* @version $Id: $Id
*/ */
public class UnauthorizedException extends Exception public class UnauthorizedException extends Exception
{ {

25
webgoat-container/src/main/java/org/owasp/webgoat/session/User.java
View File

@ -3,23 +3,48 @@ package org.owasp.webgoat.session;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Iterator; import java.util.Iterator;
/**
* <p>User class.</p>
*
* @version $Id: $Id
*/
public class User { public class User {
private String username; private String username;
private ArrayList<Role> roles; private ArrayList<Role> roles;
/**
* <p>Constructor for User.</p>
*
* @param username a {@link java.lang.String} object.
*/
public User(String username) { public User(String username) {
this.username = username; this.username = username;
this.roles = new ArrayList<Role>(); this.roles = new ArrayList<Role>();
} }
/**
* <p>Getter for the field <code>username</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getUsername() { public String getUsername() {
return username; return username;
} }
/**
* <p>Getter for the field <code>roles</code>.</p>
*
* @return a {@link java.util.Iterator} object.
*/
public Iterator<Role> getRoles() { public Iterator<Role> getRoles() {
return roles.iterator(); return roles.iterator();
} }
/**
* <p>addRole.</p>
*
* @param rolename a {@link java.lang.String} object.
*/
public void addRole(String rolename) { public void addRole(String rolename) {
roles.add(new Role(rolename)); roles.add(new Role(rolename));
} }

43
webgoat-container/src/main/java/org/owasp/webgoat/session/UserDatabase.java
View File

@ -23,6 +23,9 @@ class UserDatabase {
private final String DELETE_ALL_ROLES_FOR_USER = "DELETE FROM user_roles WHERE user_id IN (SELECT id FROM users WHERE username = ?);"; private final String DELETE_ALL_ROLES_FOR_USER = "DELETE FROM user_roles WHERE user_id IN (SELECT id FROM users WHERE username = ?);";
private final String DELETE_USER = "DELETE FROM users WHERE username = ?;"; private final String DELETE_USER = "DELETE FROM users WHERE username = ?;";
/**
* <p>Constructor for UserDatabase.</p>
*/
public UserDatabase() { public UserDatabase() {
createDefaultTables(); createDefaultTables();
if (getTableCount("users") <= 0) { if (getTableCount("users") <= 0) {
@ -36,6 +39,11 @@ class UserDatabase {
} }
} }
/**
* <p>open.</p>
*
* @return a boolean.
*/
public boolean open() { public boolean open() {
try { try {
if (userDB == null || userDB.isClosed()) { if (userDB == null || userDB.isClosed()) {
@ -52,6 +60,11 @@ class UserDatabase {
return true; return true;
} }
/**
* <p>close.</p>
*
* @return a boolean.
*/
public boolean close() { public boolean close() {
try { try {
if (userDB != null && !userDB.isClosed()) if (userDB != null && !userDB.isClosed())
@ -63,6 +76,12 @@ class UserDatabase {
return true; return true;
} }
/**
* <p>getTableCount.</p>
*
* @param tableName a {@link java.lang.String} object.
* @return a int.
*/
public int getTableCount(String tableName) { public int getTableCount(String tableName) {
int count = 0; int count = 0;
try { try {
@ -82,6 +101,11 @@ class UserDatabase {
return count; return count;
} }
/**
* <p>getUsers.</p>
*
* @return a {@link java.util.Iterator} object.
*/
public Iterator<User> getUsers() { public Iterator<User> getUsers() {
ArrayList<User> users = new ArrayList<User>(); ArrayList<User> users = new ArrayList<User>();
User currentUser; User currentUser;
@ -113,6 +137,13 @@ class UserDatabase {
return users.iterator(); return users.iterator();
} }
/**
* <p>addRoleToUser.</p>
*
* @param username a {@link java.lang.String} object.
* @param rolename a {@link java.lang.String} object.
* @return a boolean.
*/
public boolean addRoleToUser(String username, String rolename) { public boolean addRoleToUser(String username, String rolename) {
try { try {
open(); open();
@ -129,10 +160,22 @@ class UserDatabase {
return true; return true;
} }
/**
* <p>removeUser.</p>
*
* @param user a {@link org.owasp.webgoat.session.User} object.
* @return a boolean.
*/
public boolean removeUser(User user) { public boolean removeUser(User user) {
return removeUser(user.getUsername()); return removeUser(user.getUsername());
} }
/**
* <p>removeUser.</p>
*
* @param username a {@link java.lang.String} object.
* @return a boolean.
*/
public boolean removeUser(String username) { public boolean removeUser(String username) {
try { try {
open(); open();

34
webgoat-container/src/main/java/org/owasp/webgoat/session/UserTracker.java
View File

@ -8,7 +8,8 @@ import java.util.Iterator;
import java.util.Map; import java.util.Map;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -36,9 +37,9 @@ import java.util.Map;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 29, 2003 * @since October 29, 2003
* @version $Id: $Id
*/ */
public class UserTracker public class UserTracker
{ {
@ -100,6 +101,12 @@ public class UserTracker
return storage.keySet(); return storage.keySet();
} }
/**
* <p>getAllUsers.</p>
*
* @param roleName a {@link java.lang.String} object.
* @return a {@link java.util.Collection} object.
*/
public Collection<String> getAllUsers(String roleName) public Collection<String> getAllUsers(String roleName)
{ {
synchronized (usersDB) synchronized (usersDB)
@ -130,6 +137,11 @@ public class UserTracker
} }
} }
/**
* <p>deleteUser.</p>
*
* @param user a {@link java.lang.String} object.
*/
public void deleteUser(String user) public void deleteUser(String user)
{ {
synchronized (usersDB) synchronized (usersDB)
@ -161,15 +173,22 @@ public class UserTracker
* *
* @param screen * @param screen
* Description of the Parameter * Description of the Parameter
* @param userName
* Description of the Parameter
* @return The lessonTracker value * @return The lessonTracker value
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
*/ */
public LessonTracker getLessonTracker(WebSession s, Screen screen) public LessonTracker getLessonTracker(WebSession s, Screen screen)
{ {
return getLessonTracker(s, s.getUserName(), screen); return getLessonTracker(s, s.getUserName(), screen);
} }
/**
* <p>getLessonTracker.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param user a {@link java.lang.String} object.
* @param screen a {@link org.owasp.webgoat.session.Screen} object.
* @return a {@link org.owasp.webgoat.session.LessonTracker} object.
*/
public LessonTracker getLessonTracker(WebSession s, String user, Screen screen) public LessonTracker getLessonTracker(WebSession s, String user, Screen screen)
{ {
HashMap<String, LessonTracker> usermap = getUserMap(user); HashMap<String, LessonTracker> usermap = getUserMap(user);
@ -190,9 +209,8 @@ public class UserTracker
* *
* @param screen * @param screen
* Description of the Parameter * Description of the Parameter
* @param userName
* Description of the Parameter
* @return The status value * @return The status value
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
*/ */
public String getStatus(WebSession s, Screen screen) public String getStatus(WebSession s, Screen screen)
{ {
@ -249,6 +267,8 @@ public class UserTracker
* *
* @param screen * @param screen
* Description of the Parameter * Description of the Parameter
* @param screen
* Description of the Parameter
* @param s * @param s
* Description of the Parameter * Description of the Parameter
*/ */

13
webgoat-container/src/main/java/org/owasp/webgoat/session/ValidationException.java
View File

@ -1,7 +1,8 @@
package org.owasp.webgoat.session; package org.owasp.webgoat.session;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -27,6 +28,8 @@ package org.owasp.webgoat.session;
* projects. * projects.
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
*
* @version $Id: $Id
*/ */
public class ValidationException extends Exception public class ValidationException extends Exception
{ {
@ -36,11 +39,19 @@ public class ValidationException extends Exception
*/ */
private static final long serialVersionUID = -8358754606830400708L; private static final long serialVersionUID = -8358754606830400708L;
/**
* <p>Constructor for ValidationException.</p>
*/
public ValidationException() public ValidationException()
{ {
super(); super();
} }
/**
* <p>Constructor for ValidationException.</p>
*
* @param message a {@link java.lang.String} object.
*/
public ValidationException(String message) public ValidationException(String message)
{ {
super(message); super(message);

233
webgoat-container/src/main/java/org/owasp/webgoat/session/WebSession.java
View File

@ -62,8 +62,8 @@ import org.slf4j.LoggerFactory;
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect
* Security</a> * Security</a>
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* * @since October 28, 2003
* @created October 28, 2003 * @version $Id: $Id
*/ */
public class WebSession { public class WebSession {
@ -94,6 +94,7 @@ public class WebSession {
*/ */
public final static String COLOR = "color"; public final static String COLOR = "color";
/** Constant <code>COURSE="course"</code> */
public final static String COURSE = "course"; public final static String COURSE = "course";
/** /**
@ -101,6 +102,7 @@ public class WebSession {
*/ */
public final static int ERROR = 0; public final static int ERROR = 0;
/** Constant <code>STAGE="stage"</code> */
public static final String STAGE = "stage"; public static final String STAGE = "stage";
/** /**
@ -133,28 +135,40 @@ public class WebSession {
*/ */
public final static String SESSION = "websession"; public final static String SESSION = "websession";
/** Constant <code>SHOWSOURCE="ShowSource"</code> */
public final static String SHOWSOURCE = "ShowSource"; public final static String SHOWSOURCE = "ShowSource";
/** Constant <code>SHOWSOLUTION="ShowSolution"</code> */
public final static String SHOWSOLUTION = "ShowSolution"; public final static String SHOWSOLUTION = "ShowSolution";
/** Constant <code>SHOWHINTS="ShowHints"</code> */
public final static String SHOWHINTS = "ShowHints"; public final static String SHOWHINTS = "ShowHints";
/** Constant <code>SHOW="show"</code> */
public final static String SHOW = "show"; public final static String SHOW = "show";
/** Constant <code>SHOW_NEXTHINT="NextHint"</code> */
public final static String SHOW_NEXTHINT = "NextHint"; public final static String SHOW_NEXTHINT = "NextHint";
/** Constant <code>SHOW_PREVIOUSHINT="PreviousHint"</code> */
public final static String SHOW_PREVIOUSHINT = "PreviousHint"; public final static String SHOW_PREVIOUSHINT = "PreviousHint";
/** Constant <code>SHOW_PARAMS="Params"</code> */
public final static String SHOW_PARAMS = "Params"; public final static String SHOW_PARAMS = "Params";
/** Constant <code>SHOW_COOKIES="Cookies"</code> */
public final static String SHOW_COOKIES = "Cookies"; public final static String SHOW_COOKIES = "Cookies";
/** Constant <code>SHOW_SOURCE="Source"</code> */
public final static String SHOW_SOURCE = "Source"; public final static String SHOW_SOURCE = "Source";
/** Constant <code>SHOW_SOLUTION="Solution"</code> */
public final static String SHOW_SOLUTION = "Solution"; public final static String SHOW_SOLUTION = "Solution";
/** Constant <code>DEBUG="debug"</code> */
public final static String DEBUG = "debug"; public final static String DEBUG = "debug";
/** Constant <code>LANGUAGE="language"</code> */
public final static String LANGUAGE = "language"; public final static String LANGUAGE = "language";
/** /**
@ -221,7 +235,7 @@ public class WebSession {
/** /**
* Constructor for the WebSession object * Constructor for the WebSession object
* *
* @param webgoatContext * @param webgoatContext a {@link org.owasp.webgoat.session.WebgoatContext} object.
* @param context Description of the Parameter * @param context Description of the Parameter
*/ */
public WebSession(WebgoatContext webgoatContext, ServletContext context) { public WebSession(WebgoatContext webgoatContext, ServletContext context) {
@ -239,10 +253,22 @@ public class WebSession {
course.loadCourses(webgoatContext, context, "/"); course.loadCourses(webgoatContext, context, "/");
} }
/**
* <p>getConnection.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.sql.Connection} object.
* @throws java.sql.SQLException if any.
*/
public static synchronized Connection getConnection(WebSession s) throws SQLException { public static synchronized Connection getConnection(WebSession s) throws SQLException {
return DatabaseUtilities.getConnection(s); return DatabaseUtilities.getConnection(s);
} }
/**
* <p>returnConnection.</p>
*
* @param s a {@link org.owasp.webgoat.session.WebSession} object.
*/
public static void returnConnection(WebSession s) { public static void returnConnection(WebSession s) {
DatabaseUtilities.returnConnection(s.getUserName()); DatabaseUtilities.returnConnection(s.getUserName());
} }
@ -297,6 +323,11 @@ public class WebSession {
return context; return context;
} }
/**
* <p>getRoles.</p>
*
* @return a {@link java.util.List} object.
*/
public List<String> getRoles() { public List<String> getRoles() {
List<String> roles = new ArrayList<String>(); List<String> roles = new ArrayList<String>();
@ -315,13 +346,18 @@ public class WebSession {
* This is also used by the WebSession to set the admin, but the method * This is also used by the WebSession to set the admin, but the method
* should be private * should be private
* *
* @param state * @param state a boolean.
*/ */
public void setAdmin(boolean state) { public void setAdmin(boolean state) {
isAdmin = state; isAdmin = state;
} }
/**
* <p>getRole.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getRole() { public String getRole() {
String role = ""; String role = "";
@ -347,6 +383,11 @@ public class WebSession {
return course; return course;
} }
/**
* <p>Setter for the field <code>course</code>.</p>
*
* @param course a {@link org.owasp.webgoat.session.Course} object.
*/
public void setCourse(Course course) { public void setCourse(Course course) {
this.course = course; this.course = course;
} }
@ -360,14 +401,29 @@ public class WebSession {
return (currentScreen); return (currentScreen);
} }
/**
* <p>Setter for the field <code>currentScreen</code>.</p>
*
* @param screen a int.
*/
public void setCurrentScreen(int screen) { public void setCurrentScreen(int screen) {
currentScreen = screen; currentScreen = screen;
} }
/**
* <p>getRestartLink.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getRestartLink() { public String getRestartLink() {
return getCurrentLesson().getLink() + "&" + RESTART + "=" + getCurrentScreen(); return getCurrentLesson().getLink() + "&" + RESTART + "=" + getCurrentScreen();
} }
/**
* <p>getCurrentLink.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getCurrentLink() { public String getCurrentLink() {
String thisLink = "attack"; String thisLink = "attack";
Enumeration<String> e = request.getParameterNames(); Enumeration<String> e = request.getParameterNames();
@ -386,14 +442,31 @@ public class WebSession {
return thisLink; return thisLink;
} }
/**
* <p>getCurrentLesson.</p>
*
* @return a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
*/
public AbstractLesson getCurrentLesson() { public AbstractLesson getCurrentLesson() {
return getCourse().getLesson(this, getCurrentScreen(), getRoles()); return getCourse().getLesson(this, getCurrentScreen(), getRoles());
} }
/**
* <p>getLesson.</p>
*
* @param id a int.
* @return a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
*/
public AbstractLesson getLesson(int id) { public AbstractLesson getLesson(int id) {
return getCourse().getLesson(this, id, getRoles()); return getCourse().getLesson(this, id, getRoles());
} }
/**
* <p>getLessons.</p>
*
* @param category a {@link org.owasp.webgoat.lessons.Category} object.
* @return a {@link java.util.List} object.
*/
public List<AbstractLesson> getLessons(Category category) { public List<AbstractLesson> getLessons(Category category) {
return getCourse().getLessons(this, category, getRoles()); return getCourse().getLessons(this, category, getRoles());
} }
@ -407,6 +480,11 @@ public class WebSession {
return (hintNum); return (hintNum);
} }
/**
* <p>getHint.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getHint() { public String getHint() {
String hint = null; String hint = null;
int hints = getCurrentLesson().getHintCount(this); int hints = getCurrentLesson().getHintCount(this);
@ -421,6 +499,11 @@ public class WebSession {
return hint; return hint;
} }
/**
* <p>getParams.</p>
*
* @return a {@link java.util.List} object.
*/
public List<Parameter> getParams() { public List<Parameter> getParams() {
Vector<Parameter> params = null; Vector<Parameter> params = null;
@ -445,6 +528,11 @@ public class WebSession {
return params; return params;
} }
/**
* <p>getCookies.</p>
*
* @return a {@link java.util.List} object.
*/
public List<Cookie> getCookies() { public List<Cookie> getCookies() {
List<Cookie> cookies = null; List<Cookie> cookies = null;
@ -465,8 +553,8 @@ public class WebSession {
/** /**
* Gets the cookie attribute of the CookieScreen object * Gets the cookie attribute of the CookieScreen object
* *
* @param s Description of the Parameter
* @return The cookie value * @return The cookie value
* @param cookieName a {@link java.lang.String} object.
*/ */
public String getCookie(String cookieName) { public String getCookie(String cookieName) {
Cookie[] cookies = getRequest().getCookies(); Cookie[] cookies = getRequest().getCookies();
@ -480,16 +568,31 @@ public class WebSession {
return (null); return (null);
} }
/**
* <p>getSource.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getSource() { public String getSource() {
return "Sorry. No Java Source viewing available."; return "Sorry. No Java Source viewing available.";
// return getCurrentLesson().getSource(this); // return getCurrentLesson().getSource(this);
} }
/**
* <p>getSolution.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getSolution() { public String getSolution() {
return "Sorry. No solution is available."; return "Sorry. No solution is available.";
// return getCurrentLesson().getSolution(this); // return getCurrentLesson().getSolution(this);
} }
/**
* <p>getInstructions.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getInstructions() { public String getInstructions() {
return getCurrentLesson().getInstructions(this); return getCurrentLesson().getInstructions(this);
} }
@ -530,6 +633,11 @@ public class WebSession {
return request; return request;
} }
/**
* <p>Setter for the field <code>request</code>.</p>
*
* @param request a {@link javax.servlet.http.HttpServletRequest} object.
*/
public void setRequest(HttpServletRequest request) { public void setRequest(HttpServletRequest request) {
this.request = request; this.request = request;
} }
@ -555,8 +663,8 @@ public class WebSession {
/** /**
* Gets the sourceFile attribute of the WebSession object * Gets the sourceFile attribute of the WebSession object
* *
* @param screen Description of the Parameter
* @return The sourceFile value * @return The sourceFile value
* @param fileName a {@link java.lang.String} object.
*/ */
public String getWebResource(String fileName) { public String getWebResource(String fileName) {
// Note: doesn't work for admin path! Maybe with a ../ attack // Note: doesn't work for admin path! Maybe with a ../ attack
@ -601,6 +709,12 @@ public class WebSession {
private Map<AbstractLesson, LessonSession> lessonSessions = new Hashtable<AbstractLesson, LessonSession>(); private Map<AbstractLesson, LessonSession> lessonSessions = new Hashtable<AbstractLesson, LessonSession>();
/**
* <p>isAuthenticatedInLesson.</p>
*
* @param lesson a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
* @return a boolean.
*/
public boolean isAuthenticatedInLesson(AbstractLesson lesson) { public boolean isAuthenticatedInLesson(AbstractLesson lesson) {
boolean authenticated = false; boolean authenticated = false;
@ -613,32 +727,74 @@ public class WebSession {
return authenticated; return authenticated;
} }
/**
* <p>isAuthorizedInLesson.</p>
*
* @param employeeId a int.
* @param functionId a {@link java.lang.String} object.
* @return a boolean.
*/
public boolean isAuthorizedInLesson(int employeeId, String functionId) { public boolean isAuthorizedInLesson(int employeeId, String functionId) {
return getCurrentLesson().isAuthorized(this, employeeId, functionId); return getCurrentLesson().isAuthorized(this, employeeId, functionId);
} }
/**
* <p>isAuthorizedInLesson.</p>
*
* @param role a {@link java.lang.String} object.
* @param functionId a {@link java.lang.String} object.
* @return a boolean.
*/
public boolean isAuthorizedInLesson(String role, String functionId) { public boolean isAuthorizedInLesson(String role, String functionId) {
return getCurrentLesson().isAuthorized(this, role, functionId); return getCurrentLesson().isAuthorized(this, role, functionId);
} }
/**
* <p>getUserIdInLesson.</p>
*
* @return a int.
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
*/
public int getUserIdInLesson() throws ParameterNotFoundException { public int getUserIdInLesson() throws ParameterNotFoundException {
return getCurrentLesson().getUserId(this); return getCurrentLesson().getUserId(this);
} }
/**
* <p>getUserNameInLesson.</p>
*
* @return a {@link java.lang.String} object.
* @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
*/
public String getUserNameInLesson() throws ParameterNotFoundException { public String getUserNameInLesson() throws ParameterNotFoundException {
return getCurrentLesson().getUserName(this); return getCurrentLesson().getUserName(this);
} }
/**
* <p>openLessonSession.</p>
*
* @param lesson a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
*/
public void openLessonSession(AbstractLesson lesson) { public void openLessonSession(AbstractLesson lesson) {
System.out.println("Opening new lesson session for lesson " + lesson); System.out.println("Opening new lesson session for lesson " + lesson);
LessonSession lessonSession = new LessonSession(); LessonSession lessonSession = new LessonSession();
lessonSessions.put(lesson, lessonSession); lessonSessions.put(lesson, lessonSession);
} }
/**
* <p>closeLessonSession.</p>
*
* @param lesson a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
*/
public void closeLessonSession(AbstractLesson lesson) { public void closeLessonSession(AbstractLesson lesson) {
lessonSessions.remove(lesson); lessonSessions.remove(lesson);
} }
/**
* <p>getLessonSession.</p>
*
* @param lesson a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
* @return a {@link org.owasp.webgoat.session.LessonSession} object.
*/
public LessonSession getLessonSession(AbstractLesson lesson) { public LessonSession getLessonSession(AbstractLesson lesson) {
return lessonSessions.get(lesson); return lessonSessions.get(lesson);
} }
@ -692,6 +848,11 @@ public class WebSession {
message.append("<BR>" + " * " + text); message.append("<BR>" + " * " + text);
} }
/**
* <p>setLineBreak.</p>
*
* @param text a {@link java.lang.String} object.
*/
public void setLineBreak(String text) { public void setLineBreak(String text) {
message.append("<BR><BR>" + text); message.append("<BR><BR>" + text);
} }
@ -732,6 +893,11 @@ public class WebSession {
return (showSource); return (showSource);
} }
/**
* <p>showSolution.</p>
*
* @return a boolean.
*/
public boolean showSolution() { public boolean showSolution() {
return (showSolution); return (showSolution);
} }
@ -760,6 +926,7 @@ public class WebSession {
* @param request Description of the Parameter * @param request Description of the Parameter
* @param response Description of the Parameter * @param response Description of the Parameter
* @param name Description of the Parameter * @param name Description of the Parameter
* @throws java.io.IOException if any.
*/ */
public void update(HttpServletRequest request, HttpServletResponse response, String name) throws IOException { public void update(HttpServletRequest request, HttpServletResponse response, String name) throws IOException {
String content = null; String content = null;
@ -915,6 +1082,11 @@ public class WebSession {
} }
} }
/**
* <p>updateLastAttackRequestInfo.</p>
*
* @param request a {@link javax.servlet.http.HttpServletRequest} object.
*/
public void updateLastAttackRequestInfo(HttpServletRequest request) { public void updateLastAttackRequestInfo(HttpServletRequest request) {
// store cookies // store cookies
Cookie[] cookies = request.getCookies(); Cookie[] cookies = request.getCookies();
@ -946,6 +1118,11 @@ public class WebSession {
} }
} }
/**
* <p>restartLesson.</p>
*
* @param lessonId a int.
*/
public void restartLesson(int lessonId) { public void restartLesson(int lessonId) {
AbstractLesson al = getLesson(lessonId); AbstractLesson al = getLesson(lessonId);
System.out.println("Restarting lesson: " + al); System.out.println("Restarting lesson: " + al);
@ -960,7 +1137,9 @@ public class WebSession {
} }
/** /**
* @param string * <p>setHasHackableAdmin.</p>
*
* @param role a {@link java.lang.String} object.
*/ */
public void setHasHackableAdmin(String role) { public void setHasHackableAdmin(String role) {
hasHackedHackableAdmin = (AbstractLesson.HACKED_ADMIN_ROLE.equals(role) & hasHackedHackableAdmin); hasHackedHackableAdmin = (AbstractLesson.HACKED_ADMIN_ROLE.equals(role) & hasHackedHackableAdmin);
@ -972,6 +1151,8 @@ public class WebSession {
} }
/** /**
* <p>isDebug.</p>
*
* @return Returns the isDebug. * @return Returns the isDebug.
*/ */
public boolean isDebug() { public boolean isDebug() {
@ -979,13 +1160,20 @@ public class WebSession {
} }
/** /**
* <p>getHeader.</p>
*
* @param header - request header value to return * @param header - request header value to return
* @return * @return a {@link java.lang.String} object.
*/ */
public String getHeader(String header) { public String getHeader(String header) {
return getRequest().getHeader(header); return getRequest().getHeader(header);
} }
/**
* <p>getNextHint.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getNextHint() { public String getNextHint() {
String hint = null; String hint = null;
@ -1003,6 +1191,11 @@ public class WebSession {
return hint; return hint;
} }
/**
* <p>getPreviousHint.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getPreviousHint() { public String getPreviousHint() {
String hint = null; String hint = null;
@ -1018,23 +1211,45 @@ public class WebSession {
return hint; return hint;
} }
/**
* <p>Setter for the field <code>currentMenu</code>.</p>
*
* @param ranking a {@link java.lang.Integer} object.
*/
public void setCurrentMenu(Integer ranking) { public void setCurrentMenu(Integer ranking) {
currentMenu = ranking.intValue(); currentMenu = ranking.intValue();
} }
/**
* <p>Getter for the field <code>currentMenu</code>.</p>
*
* @return a int.
*/
public int getCurrentMenu() { public int getCurrentMenu() {
return currentMenu; return currentMenu;
} }
/**
* <p>Getter for the field <code>webgoatContext</code>.</p>
*
* @return a {@link org.owasp.webgoat.session.WebgoatContext} object.
*/
public WebgoatContext getWebgoatContext() { public WebgoatContext getWebgoatContext() {
return webgoatContext; return webgoatContext;
} }
/**
* <p>getCurrrentLanguage.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getCurrrentLanguage() { public String getCurrrentLanguage() {
return currentLanguage; return currentLanguage;
} }
/** /**
* <p>Getter for the field <code>cookiesOnLastRequest</code>.</p>
*
* @return the cookiesOnLastRequest * @return the cookiesOnLastRequest
*/ */
public List<Cookie> getCookiesOnLastRequest() { public List<Cookie> getCookiesOnLastRequest() {
@ -1042,6 +1257,8 @@ public class WebSession {
} }
/** /**
* <p>Getter for the field <code>parmsOnLastRequest</code>.</p>
*
* @return the parmsOnLastRequest * @return the parmsOnLastRequest
*/ */
public List<RequestParameter> getParmsOnLastRequest() { public List<RequestParameter> getParmsOnLastRequest() {

92
webgoat-container/src/main/java/org/owasp/webgoat/session/WebgoatContext.java
View File

@ -5,42 +5,64 @@ import org.slf4j.LoggerFactory;
import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServlet;
/**
* <p>WebgoatContext class.</p>
*
* @version $Id: $Id
*/
public class WebgoatContext { public class WebgoatContext {
final Logger logger = LoggerFactory.getLogger(WebgoatContext.class); final Logger logger = LoggerFactory.getLogger(WebgoatContext.class);
/** Constant <code>DATABASE_CONNECTION_STRING="DatabaseConnectionString"</code> */
public final static String DATABASE_CONNECTION_STRING = "DatabaseConnectionString"; public final static String DATABASE_CONNECTION_STRING = "DatabaseConnectionString";
/** Constant <code>DATABASE_DRIVER="DatabaseDriver"</code> */
public final static String DATABASE_DRIVER = "DatabaseDriver"; public final static String DATABASE_DRIVER = "DatabaseDriver";
/** Constant <code>DATABASE_USER="DatabaseUser"</code> */
public final static String DATABASE_USER = "DatabaseUser"; public final static String DATABASE_USER = "DatabaseUser";
/** Constant <code>DATABASE_PASSWORD="DatabasePassword"</code> */
public final static String DATABASE_PASSWORD = "DatabasePassword"; public final static String DATABASE_PASSWORD = "DatabasePassword";
/** Constant <code>ENTERPRISE="Enterprise"</code> */
public final static String ENTERPRISE = "Enterprise"; public final static String ENTERPRISE = "Enterprise";
/** Constant <code>CODING_EXERCISES="CodingExercises"</code> */
public final static String CODING_EXERCISES = "CodingExercises"; public final static String CODING_EXERCISES = "CodingExercises";
/** Constant <code>SHOWCOOKIES="ShowCookies"</code> */
public final static String SHOWCOOKIES = "ShowCookies"; public final static String SHOWCOOKIES = "ShowCookies";
/** Constant <code>SHOWPARAMS="ShowParams"</code> */
public final static String SHOWPARAMS = "ShowParams"; public final static String SHOWPARAMS = "ShowParams";
/** Constant <code>SHOWREQUEST="ShowRequest"</code> */
public final static String SHOWREQUEST = "ShowRequest"; public final static String SHOWREQUEST = "ShowRequest";
/** Constant <code>SHOWSOURCE="ShowSource"</code> */
public final static String SHOWSOURCE = "ShowSource"; public final static String SHOWSOURCE = "ShowSource";
/** Constant <code>SHOWSOLUTION="ShowSolution"</code> */
public final static String SHOWSOLUTION = "ShowSolution"; public final static String SHOWSOLUTION = "ShowSolution";
/** Constant <code>SHOWHINTS="ShowHints"</code> */
public final static String SHOWHINTS = "ShowHints"; public final static String SHOWHINTS = "ShowHints";
/** Constant <code>DEFUSEOSCOMMANDS="DefuseOSCommands"</code> */
public final static String DEFUSEOSCOMMANDS = "DefuseOSCommands"; public final static String DEFUSEOSCOMMANDS = "DefuseOSCommands";
/** Constant <code>FEEDBACK_ADDRESS_HTML="FeedbackAddressHTML"</code> */
public final static String FEEDBACK_ADDRESS_HTML = "FeedbackAddressHTML"; public final static String FEEDBACK_ADDRESS_HTML = "FeedbackAddressHTML";
/** Constant <code>FEEDBACK_ADDRESS="email"</code> */
public final static String FEEDBACK_ADDRESS = "email"; public final static String FEEDBACK_ADDRESS = "email";
/** Constant <code>DEBUG="debug"</code> */
public final static String DEBUG = "debug"; public final static String DEBUG = "debug";
/** Constant <code>DEFAULTLANGUAGE="DefaultLanguage"</code> */
public final static String DEFAULTLANGUAGE = "DefaultLanguage"; public final static String DEFAULTLANGUAGE = "DefaultLanguage";
private String databaseConnectionString; private String databaseConnectionString;
@ -83,6 +105,11 @@ public class WebgoatContext {
private java.nio.file.Path pluginDirectory; private java.nio.file.Path pluginDirectory;
/**
* <p>Constructor for WebgoatContext.</p>
*
* @param servlet a {@link javax.servlet.http.HttpServlet} object.
*/
public WebgoatContext(HttpServlet servlet) { public WebgoatContext(HttpServlet servlet) {
this.servlet = servlet; this.servlet = servlet;
databaseConnectionString = getParameter(servlet, DATABASE_CONNECTION_STRING); databaseConnectionString = getParameter(servlet, DATABASE_CONNECTION_STRING);
@ -164,54 +191,119 @@ public class WebgoatContext {
return (databasePassword); return (databasePassword);
} }
/**
* <p>isDefuseOSCommands.</p>
*
* @return a boolean.
*/
public boolean isDefuseOSCommands() { public boolean isDefuseOSCommands() {
return defuseOSCommands; return defuseOSCommands;
} }
/**
* <p>isEnterprise.</p>
*
* @return a boolean.
*/
public boolean isEnterprise() { public boolean isEnterprise() {
return enterprise; return enterprise;
} }
/**
* <p>isCodingExercises.</p>
*
* @return a boolean.
*/
public boolean isCodingExercises() { public boolean isCodingExercises() {
return codingExercises; return codingExercises;
} }
/**
* <p>Getter for the field <code>feedbackAddress</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getFeedbackAddress() { public String getFeedbackAddress() {
return feedbackAddress; return feedbackAddress;
} }
/**
* <p>Getter for the field <code>feedbackAddressHTML</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getFeedbackAddressHTML() { public String getFeedbackAddressHTML() {
return feedbackAddressHTML; return feedbackAddressHTML;
} }
/**
* <p>isDebug.</p>
*
* @return a boolean.
*/
public boolean isDebug() { public boolean isDebug() {
return isDebug; return isDebug;
} }
/**
* <p>Getter for the field <code>servletName</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getServletName() { public String getServletName() {
return servletName; return servletName;
} }
/**
* <p>isShowCookies.</p>
*
* @return a boolean.
*/
public boolean isShowCookies() { public boolean isShowCookies() {
return showCookies; return showCookies;
} }
/**
* <p>isShowParams.</p>
*
* @return a boolean.
*/
public boolean isShowParams() { public boolean isShowParams() {
return showParams; return showParams;
} }
/**
* <p>isShowRequest.</p>
*
* @return a boolean.
*/
public boolean isShowRequest() { public boolean isShowRequest() {
return showRequest; return showRequest;
} }
/**
* <p>isShowSource.</p>
*
* @return a boolean.
*/
public boolean isShowSource() { public boolean isShowSource() {
return showSource; return showSource;
} }
/**
* <p>isShowSolution.</p>
*
* @return a boolean.
*/
public boolean isShowSolution() { public boolean isShowSolution() {
return showSolution; return showSolution;
} }
/**
* <p>Getter for the field <code>defaultLanguage</code>.</p>
*
* @return a {@link java.lang.String} object.
*/
public String getDefaultLanguage() { public String getDefaultLanguage() {
return defaultLanguage; return defaultLanguage;
} }

27
webgoat-container/src/main/java/org/owasp/webgoat/session/WebgoatProperties.java
View File

@ -37,6 +37,8 @@ import org.slf4j.LoggerFactory;
* for free software projects. * for free software projects.
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
*
* @version $Id: $Id
*/ */
public class WebgoatProperties extends Properties { public class WebgoatProperties extends Properties {
@ -46,6 +48,12 @@ public class WebgoatProperties extends Properties {
private static final long serialVersionUID = 4351681705558227918L; private static final long serialVersionUID = 4351681705558227918L;
final Logger logger = LoggerFactory.getLogger(WebgoatProperties.class); final Logger logger = LoggerFactory.getLogger(WebgoatProperties.class);
/**
* <p>Constructor for WebgoatProperties.</p>
*
* @param propertiesFileName a {@link java.lang.String} object.
* @throws java.io.IOException if any.
*/
public WebgoatProperties(String propertiesFileName) throws IOException { public WebgoatProperties(String propertiesFileName) throws IOException {
if (propertiesFileName == null) { if (propertiesFileName == null) {
throw new IOException("Path to webgoat.properties is null, initialization must have failed"); throw new IOException("Path to webgoat.properties is null, initialization must have failed");
@ -58,6 +66,13 @@ public class WebgoatProperties extends Properties {
load(in); load(in);
} }
/**
* <p>getIntProperty.</p>
*
* @param key a {@link java.lang.String} object.
* @param defaultValue a int.
* @return a int.
*/
public int getIntProperty(String key, int defaultValue) { public int getIntProperty(String key, int defaultValue) {
int value = defaultValue; int value = defaultValue;
@ -69,6 +84,13 @@ public class WebgoatProperties extends Properties {
return value; return value;
} }
/**
* <p>getBooleanProperty.</p>
*
* @param key a {@link java.lang.String} object.
* @param defaultValue a boolean.
* @return a boolean.
*/
public boolean getBooleanProperty(String key, boolean defaultValue) { public boolean getBooleanProperty(String key, boolean defaultValue) {
boolean value = defaultValue; boolean value = defaultValue;
key = this.trimLesson(key); key = this.trimLesson(key);
@ -105,6 +127,11 @@ public class WebgoatProperties extends Properties {
return result; return result;
} }
/**
* <p>main.</p>
*
* @param args an array of {@link java.lang.String} objects.
*/
public static void main(String[] args) { public static void main(String[] args) {
WebgoatProperties properties = null; WebgoatProperties properties = null;
try { try {

9
webgoat-container/src/main/java/org/owasp/webgoat/util/BeanProvider.java
View File

@ -7,7 +7,8 @@ import org.springframework.context.ApplicationContextAware;
import org.springframework.stereotype.Component; import org.springframework.stereotype.Component;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -33,12 +34,15 @@ import org.springframework.stereotype.Component;
* free software projects. * free software projects.
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
*
* @version $Id: $Id
*/ */
@Component @Component
public class BeanProvider implements ApplicationContextAware public class BeanProvider implements ApplicationContextAware
{ {
private static ApplicationContext ctx; private static ApplicationContext ctx;
/** {@inheritDoc} */
@Override @Override
public void setApplicationContext(ApplicationContext applicationContext) throws BeansException public void setApplicationContext(ApplicationContext applicationContext) throws BeansException
{ {
@ -53,7 +57,8 @@ public class BeanProvider implements ApplicationContextAware
* the id of the searched bean * the id of the searched bean
* @param beanClass * @param beanClass
* the type of tye searched bean * the type of tye searched bean
* @return * @param <T> a T object.
* @return a T object.
*/ */
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
public static <T> T getBean(final String beanName, final Class<T> beanClass) public static <T> T getBean(final String beanName, final Class<T> beanClass)

6
webgoat-container/src/main/java/org/owasp/webgoat/util/Exec.java
View File

@ -9,7 +9,8 @@ import java.util.Arrays;
import java.util.BitSet; import java.util.BitSet;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -37,7 +38,8 @@ import java.util.BitSet;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @created October 28, 2003 * @since October 28, 2003
* @version $Id: $Id
*/ */
public class Exec public class Exec
{ {

4
webgoat-container/src/main/java/org/owasp/webgoat/util/ExecResults.java
View File

@ -1,7 +1,8 @@
package org.owasp.webgoat.util; package org.owasp.webgoat.util;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -29,6 +30,7 @@ package org.owasp.webgoat.util;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @version $Id: $Id
*/ */
public class ExecResults public class ExecResults
{ {

4
webgoat-container/src/main/java/org/owasp/webgoat/util/ExecutionException.java
View File

@ -1,7 +1,8 @@
package org.owasp.webgoat.util; package org.owasp.webgoat.util;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -29,6 +30,7 @@ package org.owasp.webgoat.util;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @version $Id: $Id
*/ */
public class ExecutionException extends Exception public class ExecutionException extends Exception
{ {

155
webgoat-container/src/main/java/org/owasp/webgoat/util/HtmlEncoder.java
View File

@ -5,7 +5,8 @@ import java.util.HashMap;
import java.util.Map; import java.util.Map;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -31,6 +32,8 @@ import java.util.Map;
* projects. * projects.
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
*
* @version $Id: $Id
*/ */
public class HtmlEncoder public class HtmlEncoder
{ {
@ -41,81 +44,84 @@ public class HtmlEncoder
// html entity list // html entity list
private static Object[][] entities = { { "quot", new Integer(34) }, // " - double-quote private static Object[][] entities = { { "quot", new Integer(34) }, // " - double-quote
{ "amp", new Integer(38) }, // & - ampersand { "amp", new Integer(38) }, // - ampersand
{ "lt", new Integer(60) }, // < - less-than { "lt", new Integer(60) }, // - less-than
{ "gt", new Integer(62) }, // > - greater-than { "gt", new Integer(62) }, // - greater-than
{ "nbsp", new Integer(160) }, // non-breaking space { "nbsp", new Integer(160) }, // non-breaking space
{ "copy", new Integer(169) }, // © - copyright { "copy", new Integer(169) }, // - copyright
{ "reg", new Integer(174) }, // ® - registered trademark { "reg", new Integer(174) }, // - registered trademark
{ "Agrave", new Integer(192) }, // À - uppercase A, grave accent { "Agrave", new Integer(192) }, // - uppercase A, grave accent
{ "Aacute", new Integer(193) }, // Á - uppercase A, acute accent { "Aacute", new Integer(193) }, // - uppercase A, acute accent
{ "Acirc", new Integer(194) }, // Â - uppercase A, circumflex accent { "Acirc", new Integer(194) }, // - uppercase A, circumflex accent
{ "Atilde", new Integer(195) }, // Ã - uppercase A, tilde { "Atilde", new Integer(195) }, // - uppercase A, tilde
{ "Auml", new Integer(196) }, // Ä - uppercase A, umlaut { "Auml", new Integer(196) }, // - uppercase A, umlaut
{ "Aring", new Integer(197) }, // Å - uppercase A, ring { "Aring", new Integer(197) }, // - uppercase A, ring
{ "AElig", new Integer(198) }, // Æ - uppercase AE { "AElig", new Integer(198) }, // - uppercase AE
{ "Ccedil", new Integer(199) }, // Ç - uppercase C, cedilla { "Ccedil", new Integer(199) }, // - uppercase C, cedilla
{ "Egrave", new Integer(200) }, // È - uppercase E, grave accent { "Egrave", new Integer(200) }, // - uppercase E, grave accent
{ "Eacute", new Integer(201) }, // É - uppercase E, acute accent { "Eacute", new Integer(201) }, // - uppercase E, acute accent
{ "Ecirc", new Integer(202) }, // Ê - uppercase E, circumflex accent { "Ecirc", new Integer(202) }, // - uppercase E, circumflex accent
{ "Euml", new Integer(203) }, // Ë - uppercase E, umlaut { "Euml", new Integer(203) }, // - uppercase E, umlaut
{ "Igrave", new Integer(204) }, // Ì - uppercase I, grave accent { "Igrave", new Integer(204) }, // - uppercase I, grave accent
{ "Iacute", new Integer(205) }, // Í - uppercase I, acute accent { "Iacute", new Integer(205) }, // - uppercase I, acute accent
{ "Icirc", new Integer(206) }, // Î - uppercase I, circumflex accent { "Icirc", new Integer(206) }, // - uppercase I, circumflex accent
{ "Iuml", new Integer(207) }, // Ï - uppercase I, umlaut { "Iuml", new Integer(207) }, // - uppercase I, umlaut
{ "ETH", new Integer(208) }, // Ð - uppercase Eth, Icelandic { "ETH", new Integer(208) }, // - uppercase Eth, Icelandic
{ "Ntilde", new Integer(209) }, // Ñ - uppercase N, tilde { "Ntilde", new Integer(209) }, // - uppercase N, tilde
{ "Ograve", new Integer(210) }, // Ò - uppercase O, grave accent { "Ograve", new Integer(210) }, // - uppercase O, grave accent
{ "Oacute", new Integer(211) }, // Ó - uppercase O, acute accent { "Oacute", new Integer(211) }, // - uppercase O, acute accent
{ "Ocirc", new Integer(212) }, // Ô - uppercase O, circumflex accent { "Ocirc", new Integer(212) }, // - uppercase O, circumflex accent
{ "Otilde", new Integer(213) }, // Õ - uppercase O, tilde { "Otilde", new Integer(213) }, // - uppercase O, tilde
{ "Ouml", new Integer(214) }, // Ö - uppercase O, umlaut { "Ouml", new Integer(214) }, // - uppercase O, umlaut
{ "Oslash", new Integer(216) }, // Ø - uppercase O, slash { "Oslash", new Integer(216) }, // - uppercase O, slash
{ "Ugrave", new Integer(217) }, // Ù - uppercase U, grave accent { "Ugrave", new Integer(217) }, // - uppercase U, grave accent
{ "Uacute", new Integer(218) }, // Ú - uppercase U, acute accent { "Uacute", new Integer(218) }, // - uppercase U, acute accent
{ "Ucirc", new Integer(219) }, // Û - uppercase U, circumflex accent { "Ucirc", new Integer(219) }, // - uppercase U, circumflex accent
{ "Uuml", new Integer(220) }, // Ü - uppercase U, umlaut { "Uuml", new Integer(220) }, // - uppercase U, umlaut
{ "Yacute", new Integer(221) }, // Ý - uppercase Y, acute accent { "Yacute", new Integer(221) }, // - uppercase Y, acute accent
{ "THORN", new Integer(222) }, // Þ - uppercase THORN, Icelandic { "THORN", new Integer(222) }, // - uppercase THORN, Icelandic
{ "szlig", new Integer(223) }, // ß - lowercase sharps, German { "szlig", new Integer(223) }, // - lowercase sharps, German
{ "agrave", new Integer(224) }, // à - lowercase a, grave accent { "agrave", new Integer(224) }, // - lowercase a, grave accent
{ "aacute", new Integer(225) }, // á - lowercase a, acute accent { "aacute", new Integer(225) }, // - lowercase a, acute accent
{ "acirc", new Integer(226) }, // â - lowercase a, circumflex accent { "acirc", new Integer(226) }, // - lowercase a, circumflex accent
{ "atilde", new Integer(227) }, // ã - lowercase a, tilde { "atilde", new Integer(227) }, // - lowercase a, tilde
{ "auml", new Integer(228) }, // ä - lowercase a, umlaut { "auml", new Integer(228) }, // - lowercase a, umlaut
{ "aring", new Integer(229) }, // å - lowercase a, ring { "aring", new Integer(229) }, // - lowercase a, ring
{ "aelig", new Integer(230) }, // æ - lowercase ae { "aelig", new Integer(230) }, // - lowercase ae
{ "ccedil", new Integer(231) }, // ç - lowercase c, cedilla { "ccedil", new Integer(231) }, // - lowercase c, cedilla
{ "egrave", new Integer(232) }, // è - lowercase e, grave accent { "egrave", new Integer(232) }, // - lowercase e, grave accent
{ "eacute", new Integer(233) }, // é - lowercase e, acute accent { "eacute", new Integer(233) }, // - lowercase e, acute accent
{ "ecirc", new Integer(234) }, // ê - lowercase e, circumflex accent { "ecirc", new Integer(234) }, // - lowercase e, circumflex accent
{ "euml", new Integer(235) }, // ë - lowercase e, umlaut { "euml", new Integer(235) }, // - lowercase e, umlaut
{ "igrave", new Integer(236) }, // ì - lowercase i, grave accent { "igrave", new Integer(236) }, // - lowercase i, grave accent
{ "iacute", new Integer(237) }, // í - lowercase i, acute accent { "iacute", new Integer(237) }, // - lowercase i, acute accent
{ "icirc", new Integer(238) }, // î - lowercase i, circumflex accent { "icirc", new Integer(238) }, // - lowercase i, circumflex accent
{ "iuml", new Integer(239) }, // ï - lowercase i, umlaut { "iuml", new Integer(239) }, // - lowercase i, umlaut
{ "igrave", new Integer(236) }, // ì - lowercase i, grave accent { "igrave", new Integer(236) }, // - lowercase i, grave accent
{ "iacute", new Integer(237) }, // í - lowercase i, acute accent { "iacute", new Integer(237) }, // - lowercase i, acute accent
{ "icirc", new Integer(238) }, // î - lowercase i, circumflex accent { "icirc", new Integer(238) }, // - lowercase i, circumflex accent
{ "iuml", new Integer(239) }, // ï - lowercase i, umlaut { "iuml", new Integer(239) }, // - lowercase i, umlaut
{ "eth", new Integer(240) }, // ð - lowercase eth, Icelandic { "eth", new Integer(240) }, // - lowercase eth, Icelandic
{ "ntilde", new Integer(241) }, // ñ - lowercase n, tilde { "ntilde", new Integer(241) }, // - lowercase n, tilde
{ "ograve", new Integer(242) }, // ò - lowercase o, grave accent { "ograve", new Integer(242) }, // - lowercase o, grave accent
{ "oacute", new Integer(243) }, // ó - lowercase o, acute accent { "oacute", new Integer(243) }, // - lowercase o, acute accent
{ "ocirc", new Integer(244) }, // ô - lowercase o, circumflex accent { "ocirc", new Integer(244) }, // - lowercase o, circumflex accent
{ "otilde", new Integer(245) }, // õ - lowercase o, tilde { "otilde", new Integer(245) }, // - lowercase o, tilde
{ "ouml", new Integer(246) }, // ö - lowercase o, umlaut { "ouml", new Integer(246) }, // - lowercase o, umlaut
{ "oslash", new Integer(248) }, // ø - lowercase o, slash { "oslash", new Integer(248) }, // - lowercase o, slash
{ "ugrave", new Integer(249) }, // ù - lowercase u, grave accent { "ugrave", new Integer(249) }, // - lowercase u, grave accent
{ "uacute", new Integer(250) }, // ú - lowercase u, acute accent { "uacute", new Integer(250) }, // - lowercase u, acute accent
{ "ucirc", new Integer(251) }, // û - lowercase u, circumflex accent { "ucirc", new Integer(251) }, // - lowercase u, circumflex accent
{ "uuml", new Integer(252) }, // ü - lowercase u, umlaut { "uuml", new Integer(252) }, // - lowercase u, umlaut
{ "yacute", new Integer(253) }, // ý - lowercase y, acute accent { "yacute", new Integer(253) }, // - lowercase y, acute accent
{ "thorn", new Integer(254) }, // þ - lowercase thorn, Icelandic { "thorn", new Integer(254) }, // - lowercase thorn, Icelandic
{ "yuml", new Integer(255) }, // ÿ - lowercase y, umlaut { "yuml", new Integer(255) }, // - lowercase y, umlaut
{ "euro", new Integer(8364) },// Euro symbol { "euro", new Integer(8364) },// Euro symbol
}; };
/**
* <p>Constructor for HtmlEncoder.</p>
*/
public HtmlEncoder() public HtmlEncoder()
{ {
for (int i = 0; i < entities.length; i++) for (int i = 0; i < entities.length; i++)
@ -126,10 +132,9 @@ public class HtmlEncoder
/** /**
* Turns funky characters into HTML entity equivalents * Turns funky characters into HTML entity equivalents
* <p>
* *
* e.g. <tt>"bread" & "butter"</tt> => <tt>&amp;quot;bread&amp;quot; &amp;amp; * e.g. {@code "bread" & "butter"} = {@code &amp;quot;bread&amp;quot; &amp;amp;
* &amp;quot;butter&amp;quot;</tt> . Update: supports nearly all HTML entities, including funky * &amp;quot;butter&amp;quot;}. Update: supports nearly all HTML entities, including funky
* accents. See the source code for more detail. Adapted from * accents. See the source code for more detail. Adapted from
* http://www.purpletech.com/code/src/com/purpletech/util/Utils.java. * http://www.purpletech.com/code/src/com/purpletech/util/Utils.java.
* *

10
webgoat-container/src/main/java/org/owasp/webgoat/util/Interceptor.java
View File

@ -20,7 +20,8 @@ import javax.servlet.RequestDispatcher;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -48,7 +49,7 @@ import javax.servlet.http.HttpServletRequest;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author sherif koussa - Macadamian Technologies * @author sherif koussa - Macadamian Technologies
* * @version $Id: $Id
*/ */
public class Interceptor implements Filter public class Interceptor implements Filter
{ {
@ -61,12 +62,16 @@ public class Interceptor implements Filter
* (non-Javadoc) * (non-Javadoc)
* @see javax.servlet.Filter#destroy() * @see javax.servlet.Filter#destroy()
*/ */
/**
* <p>destroy.</p>
*/
public void destroy() public void destroy()
{ {
// TODO Auto-generated method stub // TODO Auto-generated method stub
} }
/** {@inheritDoc} */
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException,
ServletException ServletException
{ {
@ -134,6 +139,7 @@ public class Interceptor implements Filter
* (non-Javadoc) * (non-Javadoc)
* @see javax.servlet.Filter#init(javax.servlet.FilterConfig) * @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
*/ */
/** {@inheritDoc} */
public void init(FilterConfig arg0) throws ServletException public void init(FilterConfig arg0) throws ServletException
{ {
// TODO Auto-generated method stub // TODO Auto-generated method stub

16
webgoat-container/src/main/java/org/owasp/webgoat/util/LabelManager.java
View File

@ -4,7 +4,8 @@ package org.owasp.webgoat.util;
import java.util.Locale; import java.util.Locale;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -30,12 +31,25 @@ import java.util.Locale;
* free software projects. * free software projects.
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
*
* @version $Id: $Id
*/ */
public interface LabelManager public interface LabelManager
{ {
/**
* <p>setLocale.</p>
*
* @param locale a {@link java.util.Locale} object.
*/
public void setLocale(Locale locale); public void setLocale(Locale locale);
/**
* <p>get.</p>
*
* @param labelKey a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
*/
public String get(String labelKey); public String get(String labelKey);
} }

15
webgoat-container/src/main/java/org/owasp/webgoat/util/LabelManagerImpl.java
View File

@ -8,7 +8,8 @@ import java.io.Serializable;
import java.util.Locale; import java.util.Locale;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -34,6 +35,8 @@ import java.util.Locale;
* free software projects. * free software projects.
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
*
* @version $Id: $Id
*/ */
@Component("labelManager") @Component("labelManager")
public class LabelManagerImpl implements LabelManager, Serializable public class LabelManagerImpl implements LabelManager, Serializable
@ -46,12 +49,21 @@ public class LabelManagerImpl implements LabelManager, Serializable
/** Locale mapped with current session. */ /** Locale mapped with current session. */
private Locale locale = new Locale(LabelProvider.DEFAULT_LANGUAGE); private Locale locale = new Locale(LabelProvider.DEFAULT_LANGUAGE);
/**
* <p>Constructor for LabelManagerImpl.</p>
*/
protected LabelManagerImpl() {} protected LabelManagerImpl() {}
/**
* <p>Constructor for LabelManagerImpl.</p>
*
* @param labelProvider a {@link org.owasp.webgoat.util.LabelProvider} object.
*/
protected LabelManagerImpl(LabelProvider labelProvider) { protected LabelManagerImpl(LabelProvider labelProvider) {
this.labelProvider = labelProvider; this.labelProvider = labelProvider;
} }
/** {@inheritDoc} */
public void setLocale(Locale locale) public void setLocale(Locale locale)
{ {
if (locale != null) if (locale != null)
@ -60,6 +72,7 @@ public class LabelManagerImpl implements LabelManager, Serializable
} }
} }
/** {@inheritDoc} */
public String get(String labelKey) public String get(String labelKey)
{ {
return labelProvider.get(locale, labelKey); return labelProvider.get(locale, labelKey);

69
webgoat-container/src/main/java/org/owasp/webgoat/util/LabelProvider.java
View File

@ -17,36 +17,41 @@ import java.util.Locale;
/** /**
* ************************************************************************************************ * *************************************************************************************************
* <p> *
* <p> *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project
* please see http://www.owasp.org/ * utility. For details, please see http://www.owasp.org/
* <p> *
* Copyright (c) 2002 - 20014 Bruce Mayhew * Copyright (c) 2002 - 20014 Bruce Mayhew
* <p> *
* This program is free software; you can redistribute it and/or modify it under the terms of the * This program is free software; you can redistribute it and/or modify it under
* GNU General Public License as published by the Free Software Foundation; either version 2 of the * the terms of the GNU General Public License as published by the Free Software
* License, or (at your option) any later version. * Foundation; either version 2 of the License, or (at your option) any later
* <p> * version.
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without *
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * This program is distributed in the hope that it will be useful, but WITHOUT
* General Public License for more details. * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* <p> * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* You should have received a copy of the GNU General Public License along with this program; if * details.
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA *
* 02111-1307, USA. * You should have received a copy of the GNU General Public License along with
* <p> * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
*
* Getting Source ============== * Getting Source ==============
* <p> *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* free software projects. * for free software projects.
* <p> *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
*
* @version $Id: $Id
*/ */
@Component @Component
@Singleton @Singleton
public class LabelProvider { public class LabelProvider {
/** Constant <code>DEFAULT_LANGUAGE="Locale.ENGLISH.getLanguage()"</code> */
public final static String DEFAULT_LANGUAGE = Locale.ENGLISH.getLanguage(); public final static String DEFAULT_LANGUAGE = Locale.ENGLISH.getLanguage();
private static final List<Locale> SUPPORTED = Arrays.asList(Locale.GERMAN, Locale.FRENCH, Locale.ENGLISH, private static final List<Locale> SUPPORTED = Arrays.asList(Locale.GERMAN, Locale.FRENCH, Locale.ENGLISH,
@ -54,6 +59,9 @@ public class LabelProvider {
private final ReloadableResourceBundleMessageSource labels = new ReloadableResourceBundleMessageSource(); private final ReloadableResourceBundleMessageSource labels = new ReloadableResourceBundleMessageSource();
private static final ReloadableResourceBundleMessageSource pluginLabels = new ReloadableResourceBundleMessageSource(); private static final ReloadableResourceBundleMessageSource pluginLabels = new ReloadableResourceBundleMessageSource();
/**
* <p>Constructor for LabelProvider.</p>
*/
public LabelProvider() { public LabelProvider() {
labels.setBasename("classpath:/i18n/WebGoatLabels"); labels.setBasename("classpath:/i18n/WebGoatLabels");
labels.setFallbackToSystemLocale(false); labels.setFallbackToSystemLocale(false);
@ -64,6 +72,11 @@ public class LabelProvider {
}); });
} }
/**
* <p>updatePluginResources.</p>
*
* @param propertyFile a {@link java.nio.file.Path} object.
*/
public static void updatePluginResources(final Path propertyFile) { public static void updatePluginResources(final Path propertyFile) {
pluginLabels.setBasename("WebGoatLabels"); pluginLabels.setBasename("WebGoatLabels");
pluginLabels.setFallbackToSystemLocale(false); pluginLabels.setFallbackToSystemLocale(false);
@ -85,10 +98,20 @@ public class LabelProvider {
}); });
} }
/**
* <p>refresh.</p>
*/
public static void refresh() { public static void refresh() {
pluginLabels.clearCache(); pluginLabels.clearCache();
} }
/**
* <p>get.</p>
*
* @param locale a {@link java.util.Locale} object.
* @param strName a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
*/
public String get(Locale locale, String strName) { public String get(Locale locale, String strName) {
return pluginLabels.getMessage(strName, null, useLocaleOrFallbackToEnglish(locale)); return pluginLabels.getMessage(strName, null, useLocaleOrFallbackToEnglish(locale));
} }

6
webgoat-container/src/main/java/org/owasp/webgoat/util/ThreadWatcher.java
View File

@ -4,7 +4,8 @@ package org.owasp.webgoat.util;
import java.util.BitSet; import java.util.BitSet;
/*************************************************************************************************** /**
*************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@ -32,7 +33,8 @@ import java.util.BitSet;
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author jwilliams@aspectsecurity.com * @author jwilliams@aspectsecurity.com
* @created November 6, 2002 * @since November 6, 2002
* @version $Id: $Id
*/ */
public class ThreadWatcher implements Runnable public class ThreadWatcher implements Runnable
{ {

26
webgoat-container/src/main/java/org/owasp/webgoat/util/WebGoatI18N.java
View File

@ -7,6 +7,11 @@ import java.util.ResourceBundle;
import org.owasp.webgoat.session.WebgoatContext; import org.owasp.webgoat.session.WebgoatContext;
@Deprecated @Deprecated
/**
* <p>WebGoatI18N class.</p>
*
* @version $Id: $Id
*/
public class WebGoatI18N public class WebGoatI18N
{ {
@ -14,18 +19,33 @@ public class WebGoatI18N
private static Locale currentLocale; private static Locale currentLocale;
private static WebGoatResourceBundleController localeController; private static WebGoatResourceBundleController localeController;
/**
* <p>Constructor for WebGoatI18N.</p>
*
* @param context a {@link org.owasp.webgoat.session.WebgoatContext} object.
*/
public WebGoatI18N(WebgoatContext context) public WebGoatI18N(WebgoatContext context)
{ {
currentLocale = new Locale(context.getDefaultLanguage()); currentLocale = new Locale(context.getDefaultLanguage());
localeController = new WebGoatResourceBundleController(currentLocale); localeController = new WebGoatResourceBundleController(currentLocale);
} }
/**
* <p>loadLanguage.</p>
*
* @param language a {@link java.lang.String} object.
*/
@Deprecated @Deprecated
public static void loadLanguage(String language) public static void loadLanguage(String language)
{ {
// Do nothing // Do nothing
} }
/**
* <p>Setter for the field <code>currentLocale</code>.</p>
*
* @param locale a {@link java.util.Locale} object.
*/
public static void setCurrentLocale(Locale locale) public static void setCurrentLocale(Locale locale)
{ {
if (!currentLocale.equals(locale)) if (!currentLocale.equals(locale))
@ -39,6 +59,12 @@ public class WebGoatI18N
} }
} }
/**
* <p>get.</p>
*
* @param strName a {@link java.lang.String} object.
* @return a {@link java.lang.String} object.
*/
public static String get(String strName) public static String get(String strName)
{ {
return labels.get(WebGoatI18N.currentLocale).getString(strName); return labels.get(WebGoatI18N.currentLocale).getString(strName);

7
webgoat-container/src/main/resources/i18n/WebGoatLabels_en.properties Normal file
View File

@ -0,0 +1,7 @@
#General
LessonCompleted=Congratulations. You have successfully completed this lesson.
RestartLesson=Restart this Lesson
SolutionVideos=Solution Videos
ErrorGenerating=Error generating
InvalidData=Invalid Data
Go!=Go!

38
webgoat-container/src/test/java/org/owasp/webgoat/plugins/WebGoatIT.java
View File

@ -55,10 +55,11 @@ public class WebGoatIT implements SauceOnDemandSessionIdProvider {
@Rule @Rule
public SauceOnDemandTestWatcher resultReportingTestWatcher = new SauceOnDemandTestWatcher(this, authentication); public SauceOnDemandTestWatcher resultReportingTestWatcher = new SauceOnDemandTestWatcher(this, authentication);
@Rule public TestName name = new TestName() { @Rule
public TestName name = new TestName() {
public String getMethodName() { public String getMethodName() {
return String.format("%s : (%s %s %s)", super.getMethodName(), os, browser, version); return String.format("%s : (%s %s %s)", super.getMethodName(), os, browser, version);
}; }
}; };
/** /**
@ -120,8 +121,8 @@ public class WebGoatIT implements SauceOnDemandSessionIdProvider {
public static LinkedList browsersStrings() { public static LinkedList browsersStrings() {
LinkedList browsers = new LinkedList(); LinkedList browsers = new LinkedList();
// windows 7, Chrome 41 // windows 7, Chrome 45
browsers.add(new String[]{"Windows 7", "41", "chrome", null, null}); browsers.add(new String[]{"Windows 7", "45", "chrome", null, null});
// windows 7, IE 9 // windows 7, IE 9
//browsers.add(new String[]{"Windows 7", "9", "internet explorer", null, null}); //browsers.add(new String[]{"Windows 7", "9", "internet explorer", null, null});
@ -132,14 +133,20 @@ public class WebGoatIT implements SauceOnDemandSessionIdProvider {
// windows 8.1, IE 11 // windows 8.1, IE 11
//browsers.add(new String[]{"Windows 8.1", "11", "internet explorer", null, null}); //browsers.add(new String[]{"Windows 8.1", "11", "internet explorer", null, null});
// windows 10, Microsoft Edge Browser
//browsers.add(new String[]{"Windows 10", "20.10240", "microsoftedge", null, null});
// OS X 10.9, Safari 7 // OS X 10.9, Safari 7
//browsers.add(new String[]{"OSX 10.9", "7", "safari", null, null}); //browsers.add(new String[]{"OSX 10.9", "7", "safari", null, null});
// OS X 10.10, Safari 7 // OS X 10.10, Safari
//browsers.add(new String[]{"OSX 10.10", "8", "safari", null, null}); //browsers.add(new String[]{"OSX 10.10", "8", "safari", null, null});
// OS X 10.11, Safari
//browsers.add(new String[]{"OSX 10.11", "8.1", "safari", null, null});
// Linux, Firefox 37 // Linux, Firefox 37
//browsers.add(new String[]{"Linux", "37", "firefox", null, null}); browsers.add(new String[]{"Linux", "37", "firefox", null, null});
return browsers; return browsers;
} }
@ -160,6 +167,11 @@ public class WebGoatIT implements SauceOnDemandSessionIdProvider {
if (deviceName != null) capabilities.setCapability("deviceName", deviceName); if (deviceName != null) capabilities.setCapability("deviceName", deviceName);
if (deviceOrientation != null) capabilities.setCapability("device-orientation", deviceOrientation); if (deviceOrientation != null) capabilities.setCapability("device-orientation", deviceOrientation);
// Additional settings to help debugging and improve job perf
capabilities.setCapability("public", "share");
capabilities.setCapability("wwebdriverRemoteQuietExceptions", false);
capabilities.setCapability("captureHtml", true);
if ( System.getenv("CI") != null && System.getenv("TRAVIS").equals("true")) { if ( System.getenv("CI") != null && System.getenv("TRAVIS").equals("true")) {
capabilities.setCapability("tunnelIdentifier", System.getenv("TRAVIS_JOB_NUMBER")); capabilities.setCapability("tunnelIdentifier", System.getenv("TRAVIS_JOB_NUMBER"));
capabilities.setCapability("tags", System.getenv("TRAVIS_PULL_REQUEST")); capabilities.setCapability("tags", System.getenv("TRAVIS_PULL_REQUEST"));
@ -184,17 +196,18 @@ public class WebGoatIT implements SauceOnDemandSessionIdProvider {
public void doLoginWebgoatUser() { public void doLoginWebgoatUser() {
driver.get(baseWebGoatUrl + "/login.mvc"); driver.get(baseWebGoatUrl + "/login.mvc");
driver.navigate().refresh();
WebDriverWait wait = new WebDriverWait(driver, 10); // wait for a maximum of 5 seconds WebDriverWait wait = new WebDriverWait(driver, 15); // wait for a maximum of 15 seconds
wait.until(ExpectedConditions.presenceOfElementLocated(By.id("exampleInputEmail1"))); wait.until(ExpectedConditions.presenceOfElementLocated(By.id("exampleInputEmail1")));
wait.until(ExpectedConditions.presenceOfElementLocated(By.id("exampleInputPassword1"))); wait.until(ExpectedConditions.presenceOfElementLocated(By.id("exampleInputPassword1")));
WebElement usernameElement = driver.findElement(By.name("username")); WebElement usernameElement = driver.findElement(By.name("username"));
WebElement passwordElement = driver.findElement(By.name("password")); WebElement passwordElement = driver.findElement(By.name("password"));
usernameElement.sendKeys(loginUser); usernameElement.sendKeys(loginUser);
passwordElement.sendKeys(loginPassword); passwordElement.sendKeys(loginPassword);
passwordElement.submit(); passwordElement.submit();
driver.get(baseWebGoatUrl + "/start.mvc");
} }
/** /**
@ -204,7 +217,7 @@ public class WebGoatIT implements SauceOnDemandSessionIdProvider {
@Test @Test
public void verifyWebGoatLoginPage() throws Exception { public void verifyWebGoatLoginPage() throws Exception {
driver.get(baseWebGoatUrl + "/login.mvc"); driver.get(baseWebGoatUrl + "/login.mvc");
WebDriverWait wait = new WebDriverWait(driver, 10); // wait for a maximum of 5 seconds WebDriverWait wait = new WebDriverWait(driver, 15); // wait for a maximum of 15 seconds
wait.until(ExpectedConditions.presenceOfElementLocated(By.id("exampleInputEmail1"))); wait.until(ExpectedConditions.presenceOfElementLocated(By.id("exampleInputEmail1")));
wait.until(ExpectedConditions.presenceOfElementLocated(By.id("exampleInputPassword1"))); wait.until(ExpectedConditions.presenceOfElementLocated(By.id("exampleInputPassword1")));
@ -222,7 +235,7 @@ public class WebGoatIT implements SauceOnDemandSessionIdProvider {
driver.get(baseWebGoatUrl + "/start.mvc"); driver.get(baseWebGoatUrl + "/start.mvc");
WebDriverWait wait = new WebDriverWait(driver, 10); // wait for a maximum of 5 seconds WebDriverWait wait = new WebDriverWait(driver, 15); // wait for a maximum of 15 seconds
wait.until(ExpectedConditions.presenceOfElementLocated(By.name("username"))); wait.until(ExpectedConditions.presenceOfElementLocated(By.name("username")));
wait.until(ExpectedConditions.presenceOfElementLocated(By.name("password"))); wait.until(ExpectedConditions.presenceOfElementLocated(By.name("password")));
} }
@ -232,7 +245,10 @@ public class WebGoatIT implements SauceOnDemandSessionIdProvider {
doLoginWebgoatUser(); doLoginWebgoatUser();
assertTrue("user: webgoat is not in the page source", driver.getPageSource().contains("User: webgoat")); driver.get(baseWebGoatUrl + "/start.mvc");
String pageSource = driver.getPageSource();
assertTrue("user: webgoat is not in the page source", pageSource.contains("Role: webgoat_admin"));
WebElement cookieParameters = driver.findElement(By.id("cookies-and-params")); WebElement cookieParameters = driver.findElement(By.id("cookies-and-params"));
assertNotNull("element id=cookieParameters should be displayed to user upon successful login", cookieParameters); assertNotNull("element id=cookieParameters should be displayed to user upon successful login", cookieParameters);
} }