chore: add pre-commit hooks

chore: add pre-commit hooks

chore: add pre-commit hooks

chore: add pre-commit hooks

chore: add pre-commit hooks

.github/dependabot.yml

@@ -12,4 +12,3 @@ updates:
         directory: "/"
         schedule:
             interval: "weekly"
-

.github/workflows/pre-commit.yaml

@@ -0,0 +1,29 @@
+name: Pre-commit check
+
+on:
+    pull_request:
+        branches: [main]
+    workflow_dispatch:
+
+permissions:
+    contents: read
+jobs:
+    pre-commit:
+        name: Pre-commit check
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout git repository
+              uses: actions/checkout@v4
+            - name: Setup python
+              uses: actions/setup-python@v4
+              with:
+                    python-version: "3.9"
+            - uses: actions/setup-java@v3
+              with:
+                  distribution: 'temurin'
+                  java-version: '17'
+            - name: Pre-commit checks
+              uses: pre-commit/action@v3.0.0
+            - name: pre-commit-ci-lite
+              uses: pre-commit-ci/lite-action@v1.0.1
+              if: always()

.github/workflows/release.yml

@@ -147,4 +147,3 @@ jobs:
             github_token: "${{ secrets.GITHUB_TOKEN }}"
             title: ${{ github.event.commits[0].message }}
             target_branch: main
-

.pre-commit-config.yaml

@@ -0,0 +1,28 @@
+ci:
+  autofix_commit_msg: |
+    [pre-commit.ci] auto fixes from pre-commit.com hooks
+  autofix_prs: false # managed in the action step
+  autoupdate_branch: ""
+  autoupdate_commit_msg: "[pre-commit.ci] pre-commit autoupdate"
+  autoupdate_schedule: weekly
+  skip: []
+  submodules: false
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.4.0
+    hooks:
+      - id: check-yaml
+      - id: end-of-file-fixer
+        exclude: ^(README.md|CREATE_RELEASE.md)
+      - id: trailing-whitespace
+  - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
+    rev: v9.5.0
+    hooks:
+      - id: commitlint
+        stages: [commit-msg]
+  - repo: https://github.com/ejba/pre-commit-maven
+    rev: v0.3.4
+    hooks:
+      - id: maven
+        args: [ 'clean compile' ]
+      - id: maven-spotless-apply

FAQ.md

@@ -5,4 +5,3 @@
 ### Integration tests fail
 
 Try to run the command in the console `java -jar ...` and remove `-Dlogging.pattern.console=` from the command line.
-

README_I18N.md

@@ -17,18 +17,18 @@ The following steps are required when you want to add a new language
 1. Update [main_new.html](src/main/resources/webgoat/static/main_new.html)
    1. Add the parts for showing the flag and providing the correct value for the flag= parameter
       2.
-3. Add a flag image to src/main/resources/webgoat/static/css/img
+2. Add a flag image to src/main/resources/webgoat/static/css/img
    1. See the main_new.html for a link to download flag resources
-4. Add a welcome page to the introduction lesson
+3. Add a welcome page to the introduction lesson
    1. Copy Introduction_.adoc to Introduction_es.adoc (if in this case you want to add Spanish)
    2. Add a highlighted section that explains that most parts of WebGoat will still be in English and invite people to translate parts where it would be valuable
-5. Translate the main labels
+4. Translate the main labels
    1. Copy messages.properties to messages_es.properties (if in this case you want to add Spanish)
    2. Translate the label values
-6. Optionally translate lessons by
+5. Optionally translate lessons by
    1. Adding lang specifc adoc files in documentation folder of the lesson
    2. Adding WebGoatLabels.properties of a specific language if you want to
-7. Run mvn clean to see if the LabelAndHintIntegration test passes
+6. Run mvn clean to see if the LabelAndHintIntegration test passes
-8. Run WebGoat and verify that your own language and the other languages work as expected
+7. Run WebGoat and verify that your own language and the other languages work as expected
 
 If you only want to translate more for a certain language, you only need to do step 4-8

RELEASE_NOTES.md

@@ -215,4 +215,3 @@ Special thanks to the following contributors providing us with a pull request:
 And everyone who provided feedback through Github.
 
 Team WebGoat
-

docs/README.md

@@ -1,4 +1,3 @@
 # WebGoat landing page
 
 Old GitHub page which now redirects to OWASP website.
-

src/main/resources/application-webgoat.properties

@@ -70,4 +70,3 @@ management.endpoints.web.exposure.include=env, health,configprops
 
 spring.security.oauth2.client.registration.github.client-id=${WEBGOAT_OAUTH_CLIENTID:dummy}
 spring.security.oauth2.client.registration.github.client-secret=${WEBGOAT_OAUTH_CLIENTSECRET:dummy}
-

src/main/resources/db/container/V3__id.sql

@@ -1,4 +1,3 @@
 ALTER TABLE CONTAINER.ASSIGNMENT ALTER COLUMN ID SET GENERATED BY DEFAULT AS IDENTITY(START WITH 1);
 ALTER TABLE CONTAINER.LESSON_TRACKER ALTER COLUMN ID SET GENERATED BY DEFAULT AS IDENTITY(START WITH 1);
 ALTER TABLE CONTAINER.USER_TRACKER ALTER COLUMN ID SET GENERATED BY DEFAULT AS IDENTITY(START WITH 1);
-

src/main/resources/i18n/messages_de.properties

@@ -38,4 +38,3 @@ password=Passwort
 password.confirm=Wiederhohl Passwort
 sign.up=Anmelden
 register.title=Registrieren
-

src/main/resources/lessons/authbypass/i18n/WebGoatLabels.properties

@@ -8,4 +8,3 @@ auth-bypass.hints.verify.1=The attack on this is similar to the story referenced
 auth-bypass.hints.verify.2=You do want to tamper the  security  question parameters, but not delete them
 auth-bypass.hints.verify.3=The logic to verify the account does expect 2 security questions to be answered, but there is a flaw in the implementation
 auth-bypass.hints.verify.4=Have you tried renaming the secQuestion0 and secQuestion1 parameters?
-

src/main/resources/lessons/clientsidefiltering/html/ClientSideFiltering.html

@@ -164,6 +164,3 @@
 </div>
 
 </html>
-
-
-

src/main/resources/lessons/cryptography/documentation/Crypto_plan.adoc

@@ -31,5 +31,3 @@ The goal is to get familiar with the following forms of techniques:
 === Assignments
 
 After the explanation of an item there will be several assignments.
-
-

src/main/resources/lessons/cryptography/documentation/defaults.adoc

@@ -28,6 +28,3 @@ You can find the secret in the following docker image, which you can start as:
 ----
 echo "U2FsdGVkX199jgh5oANElFdtCxIEvdEvciLi+v+5loE+VCuy6Ii0b+5byb5DXp32RPmT02Ek1pf55ctQN+DHbwCPiVRfFQamDmbHBUpD7as=" | openssl enc -aes-256-cbc -d -a -kfile ....
 ----
-
-
-

src/main/resources/lessons/cryptography/documentation/encoding_plan.adoc

@@ -23,4 +23,3 @@ Basic authentication is sometimes used by web applications. This uses base64 enc
 The HTTP header will look like:
 
 	Authorization: Basic bXl1c2VyOm15cGFzc3dvcmQ=
-	

src/main/resources/lessons/cryptography/documentation/encryption.adoc

@@ -28,5 +28,3 @@ Here is a short description of what happens if you open your browser and go to a
 * At the end of this process both the browser and the webserver will use the exchanged symmetric key (in the asymmetric key exchange process) to encrypt and decrypt messages that are sent back and forth between the browser and the webserver.
 
 Symmetric keys are used because it can be used more easily with large sets of data and requires less processing power in doing so. However, the information on these pages is just for a basic understanding of cryptography. Look on the internet for more detailed information about these topics.
-
-

src/main/resources/lessons/cryptography/documentation/signing.adoc

@@ -36,5 +36,3 @@ Governments usually send official documents with a PDF that contains a certifica
 == Assignment
 
 Here is a simple assignment. A private RSA key is sent to you. Determine the modulus of the RSA key as a hex string, and calculate a signature for that hex string using the key. The exercise requires some experience with OpenSSL. You can search on the Internet for useful commands and/or use the HINTS button to get some tips.
-
-

src/main/resources/lessons/csrf/documentation/CSRF_Frameworks.adoc

@@ -20,8 +20,3 @@ with the server are performed with JavaScript. On the server side you only need
 if this header is not present deny the request.
 Some frameworks offer this implementation by default however researcher Alex Infuhr found out that this can be bypassed
 as well. You can read about: https://insert-script.blogspot.com/2018/05/adobe-reader-pdf-client-side-request.html[Adobe Reader PDF - Client Side Request Injection]
-
-
-
-
-

src/main/resources/lessons/csrf/documentation/CSRF_GET.adoc

@@ -6,5 +6,3 @@ This is the most simple CSRF attack to perform. For example you receive an e-mai
 
 If the user is still logged in to the website of bank.com this simple GET request will transfer money from one account to another.
 Of course in most cases the website might have multiple controls to approve the request.
-
-

src/main/resources/lessons/csrf/documentation/CSRF_Get_Flag.adoc

@@ -1,4 +1,3 @@
 == Basic Get CSRF Exercise
 
 Trigger the form below from an external source while logged in. The response will include a 'flag' (a numeric value).
-

src/main/resources/lessons/csrf/documentation/CSRF_Reviews.adoc

@@ -6,4 +6,3 @@ finding somewhere that you want to execute the CSRF attack. The classic example
 
 But we're keeping it simple here.  In this case, you just need to trigger a review submission on behalf of the currently
 logged in user.
-

src/main/resources/lessons/csrf/documentation/CSRF_intro.adoc

@@ -21,7 +21,3 @@ something. Forcing the victim to retrieve data doesn't benefit an attacker becau
 As such, CSRF attacks target state-changing requests.
 
 Let's continue with some exercises to address way to perform a CSRF request.
-
-
-
-

src/main/resources/lessons/hijacksession/documentation/HijackSession_content0.adoc

@@ -1,4 +1,3 @@
 = Hijack a Session
 
 In this lesson we are trying to predict the 'hijack_cookie' value. The 'hijack_cookie' is used to differentiate authenticated and anonymous users of WebGoat.
-

src/main/resources/lessons/httpbasics/documentation/HttpBasics_content2.adoc

@@ -1,4 +1,3 @@
 == The Quiz
 
 What type of HTTP command did WebGoat use for this lesson.  A POST or a GET.
-

src/main/resources/lessons/httpbasics/documentation/HttpBasics_plan.adoc

@@ -25,4 +25,3 @@ The client initiates a transaction as follows:
 ** User-Agent: Mozilla/4.06 Accept: image/gif,image/jpeg, */*
 
 * In a POST request, the user supplied data will follow the optional headers and is not part of the contained within the POST URL.
-

src/main/resources/lessons/httpproxies/documentation/1proxysetupsteps.adoc

@@ -7,5 +7,3 @@ Otherwise, this will show you how to set up ZAP as a proxy on your local host.
 * First download and install https://www.zaproxy.org/download/[ZAP] for your operating system
 * Start ZAP
 * Start the browser directly from ZAP
-
-

src/main/resources/lessons/httpproxies/documentation/7resend.adoc

@@ -26,5 +26,3 @@ image::images/zap_edit_and_send.png[Open/Resend with Request Editor,style="lesso
 ++++
 
 image::images/zap_edit_and_response.png[Open/Resend response,style="lesson-image"]
-
-

src/main/resources/lessons/httpproxies/documentation/9manual.adoc

@@ -52,5 +52,3 @@ image::images/chrome-manual-proxy.png[Chrome Proxy Config,700,447,style="lesson-
 image::images/chrome-manual-proxy-win.png[Chrome Proxy, 394,346,style="lesson-image"]
 
 (Win config image above)
-
-

src/main/resources/lessons/jwt/documentation/JWT_claim_misuse_jku.adoc

@@ -56,4 +56,3 @@ Instead, use static keys that are securely managed and updated regularly.
 - **Audit and monitoring**: Regularly audit JWT usage, monitor for suspicious activity, and implement anomaly detection mechanisms.
 
 - **Security testing**: Regularly perform security testing, including penetration testing and code reviews, to identify and remediate potential vulnerabilities.
-

src/main/resources/lessons/jwt/documentation/JWT_claim_misuse_kid_assignment.adoc

@@ -3,4 +3,3 @@
 Below you see two accounts, one of Jerry and one of Tom.
 Jerry wants to remove Tom's account from Twitter, but his token can only delete his account.
 Can you try to help him and delete Toms account?
-

src/main/resources/lessons/jwt/documentation/JWT_decode.adoc

@@ -9,4 +9,3 @@ eyJhbGciOiJIUzI1NiJ9.ew0KICAiYXV0aG9yaXRpZXMiIDogWyAiUk9MRV9BRE1JTiIsICJST0xFX1V
 ----
 
 Copy and paste the following token and decode the token, can you find the user inside the token?
-

src/main/resources/lessons/jwt/documentation/JWT_libraries_assignment.adoc

@@ -58,4 +58,3 @@ try {
 ----
 
 Can you spot the weakness?
-

src/main/resources/lessons/jwt/documentation/JWT_login_to_token.adoc

@@ -16,4 +16,3 @@ information in the token to identify the user.
 
 The token contains claims to identify the user and all other information necessary for the server to fulfill the request.
 Be aware not to store sensitive information in the token and always send it over a secure channel.
-

src/main/resources/lessons/jwt/documentation/JWT_plan.adoc

@@ -34,7 +34,3 @@ the validity and integrity of the token in a secure way, all of this in a statel
 and portable approach (portable in the way that client and server technologies can
 be different including also the transport channel even if HTTP is the most often used)
 -------------------------------------------------------
-
-
-
-

src/main/resources/lessons/jwt/documentation/JWT_refresh.adoc

@@ -85,4 +85,3 @@ application you are better of using plain old cookies. See for more information:
 - http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/[stop-using-jwt-for-sessions, window="_blank"]
 - http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions-part-2-why-your-solution-doesnt-work/[stop-using-jwt-for-sessions-part-2-why-your-solution-doesnt-work, window="_blank"]
 - http://cryto.net/~joepie91/blog/attachments/jwt-flowchart.png[flowchart, window="_blank"]
-

src/main/resources/lessons/jwt/documentation/JWT_refresh_assignment.adoc

@@ -9,5 +9,3 @@ found in a private bug bounty program on Bugcrowd, you can read the full write u
 
 From a breach of last year the following logfile is available link:images/logs.txt[here]
 Can you find a way to order the books but let *Tom* pay for them?
-
-

src/main/resources/lessons/jwt/documentation/JWT_signing.adoc

@@ -14,7 +14,3 @@ to be aware of before validating the token.
 == Assignment
 
 Try to change the token you receive and become an admin user by changing the token and once you are admin reset the votes
-
-
-
-

src/main/resources/lessons/jwt/documentation/JWT_signing_solution.adoc

@@ -86,6 +86,3 @@ Now we can replace the token in the cookie and perform the reset again. One thin
 For more information take a look at the following video:
 
 video::wt3UixCiPfo[youtube, height=480, width=100%]
-
-
-

src/main/resources/lessons/jwt/documentation/JWT_structure.adoc

@@ -13,5 +13,3 @@ The token is base64 encoded and consists of three parts:
 
 Both header and claims consist are represented by a JSON object. The header describes the cryptographic operations applied to the JWT and optionally, additional properties of the JWT.
 The claims represent a JSON object whose members are the claims conveyed by the JWT.
-
-

src/main/resources/lessons/jwt/documentation/JWT_weak_keys

@@ -7,4 +7,3 @@ dictionary attack is not feasible. Once you have a token you can start an offlin
 === Assignment
 
 Given we have the following token try to find out secret key and submit a new key with the username changed to WebGoat.
-

src/main/resources/lessons/jwt/js/jwt-buy.js

@@ -31,6 +31,3 @@ function updateTotal() {
 
 
 }
-
-
-

src/main/resources/lessons/jwt/js/jwt-final.js

@@ -6,4 +6,3 @@ function follow(user) {
         $("#toast").append(result);
     })
 }
-

src/main/resources/lessons/jwt/js/jwt-voting.js

@@ -84,4 +84,3 @@ function vote(title) {
         )
     }
 }
-

src/main/resources/lessons/lessontemplate/documentation/lesson-template-intro.adoc

@@ -6,4 +6,3 @@ This lesson describes the steps needed to add a new lesson to WebGoat. In genera
 - Add one or more assignments within the lesson
 
 Let's see how to create a new lesson.
-

src/main/resources/lessons/lessontemplate/i18n/WebGoatLabels.properties

@@ -8,4 +8,3 @@ lesson-template.sample-attack.failure-1=Sample failure message
 lesson-template.sample-attack.failure-2=Sample failure message 2
 
 lesson-template.sample-attack.success=Sample success message
-

src/main/resources/lessons/logging/i18n/WebGoatLabels.properties

@@ -1,2 +1 @@
 logging.title=Logging Security
-

src/main/resources/lessons/passwordreset/documentation/PasswordReset_host_header.adoc

@@ -17,4 +17,3 @@ that password. Note: it is not possible to use OWASP ZAP for this lesson, also b
 tools like `curl` and the like will be more successful for this attack.
 
 Tom always resets his password immediately after receiving the email with the link.
-

src/main/resources/lessons/passwordreset/documentation/PasswordReset_known_questions.adoc

@@ -18,6 +18,3 @@ resets, a good resource for security questions is: http://goodsecurityquestions.
 Users can retrieve their password if they can answer the secret question properly. There is no lock-out mechanism on
 this 'Forgot Password' page. Your username is 'webgoat' and your favorite color is 'red'. The goal is to retrieve the
 password of another user. Users you could try are: "tom", "admin" and "larry".
-
-
-

src/main/resources/lessons/passwordreset/documentation/PasswordReset_simple.adoc

@@ -3,4 +3,3 @@
 Let's first do a simple assignment to make sure you are able to read e-mails with WebWolf, first start WebWolf (see webWolfLink:here[])
 In the reset page below send an e-mail to `username@webgoat.org` (part behind the @ is not important)
 Open WebWolf and read the e-mail and login with your username and the password provided in the e-mail.
-

src/main/resources/lessons/pathtraversal/documentation/PathTraversal_intro.adoc

@@ -19,5 +19,3 @@ it again to `../`.
 Also, note that avoiding applications filtering those encodings double encoding might work as well. Double encoding
 might be necessary when you have a system A which calls system B. System A will only decode once and
 call B with the still encoded URL.
-
-

src/main/resources/lessons/pathtraversal/documentation/PathTraversal_retrieval.adoc

@@ -2,5 +2,3 @@
 
 Path traversals are not limited to file uploads; when retrieving files, it can be the case that a path traversal
 is possible to retrieve other files from the system. In this assignment, try to find a file called `path-traversal-secret.jpg`
-
-

src/main/resources/lessons/pathtraversal/documentation/PathTraversal_upload_mitigation.adoc

@@ -67,4 +67,3 @@ if you replace `1.jpg` with `../../secret.txt`, it will block the request. With
 will not be there.
 
 In the lesson about "File uploads" more examples of vulnerabilities are shown.
-

src/main/resources/lessons/pathtraversal/documentation/PathTraversal_zip_slip_assignment.adoc

@@ -11,5 +11,3 @@ To make the assignment a bit easier below you will find the location of the prof
 |`webGoatTempDir:temppath[]PathTraversal/username:user[]/username:user[].jpg`
 
 |===
-
-

src/main/resources/lessons/pathtraversal/i18n/WebGoatLabels.properties

@@ -55,4 +55,3 @@ path-traversal-zip-slip.hint4=Check the http request to find out which image nam
 
 path-traversal-zip-slip.no-zip=Please upload a zip file
 path-traversal-zip-slip.extracted=Zip file extracted successfully failed to copy the image. Please get in touch with our helpdesk.
-

src/main/resources/lessons/sol.txt

@@ -88,5 +88,3 @@ for the deserialization:  got to the link: http://www.pwntester.com/blog/2013/12
    </handler>
  </dynamic-proxy>
 </sorted-set>
-
-

src/main/resources/lessons/spoofcookie/js/handler.js

@@ -28,4 +28,3 @@ var obs = new MutationObserver(function(mutations) {
 });
 
 obs.observe(target, { characterData: false, attributes: false, childList: true, subtree: false });
-

src/main/resources/lessons/sqlinjection/db/migration/V2021_03_13_8__grant.sql

@@ -11,4 +11,3 @@ INSERT INTO grant_rights VALUES ('89762','Tobi',     'Barnett', 'Development', 7
 INSERT INTO grant_rights VALUES ('96134','Bob',      'Franco',  'Marketing',   83700);
 INSERT INTO grant_rights VALUES ('34477','Abraham ', 'Holman',  'Development', 50000);
 INSERT INTO grant_rights VALUES ('37648','John',     'Smith',   'Marketing',   64350);
-

src/main/resources/lessons/sqlinjection/documentation/SqlInjection_content12.adoc

@@ -10,4 +10,3 @@
 * SQL injection
 
 === Often the database is considered trusted
-

src/main/resources/lessons/sqlinjection/documentation/SqlInjection_content12a.adoc

@@ -10,4 +10,3 @@ Let's repeat one of the previous assignments, the developer fixed the possible S
 spot the weakness in this approach?
 
 Read about the lesson goal link:start.mvc#lesson/SqlInjectionAdvanced.lesson/2[here].
-

src/main/resources/lessons/sqlinjection/documentation/SqlInjection_content12b.adoc

@@ -4,5 +4,3 @@ So the last attempt to validate if the query did not contain any spaces failed,
 into the direction of only performing input validation, can you find out where it went wrong this time?
 
 Read about the lesson goal link:start.mvc#lesson/SqlInjectionAdvanced.lesson/2[here].
-
-

src/main/resources/lessons/sqlinjection/documentation/SqlInjection_content6c.adoc

@@ -56,4 +56,3 @@ To achieve this kind of SQL injection you could use:
 ----
 article = 4; sleep(10) --
 ----
-

src/main/resources/lessons/sqlinjection/documentation/SqlInjection_content9.adoc

@@ -48,4 +48,3 @@ statement.setString(2, "webgoat");
 statement.setString(3, "webgoat@owasp.org");
 statement.executeUpdate();
 ----
-

src/main/resources/lessons/sqlinjection/documentation/SqlInjection_introduction_content2.adoc

@@ -20,6 +20,3 @@ If an attacker succeeds in "injecting" DML statements into a SQL database, he ca
 === It is your turn!
 Try to change the department of Tobi Barnett to 'Sales'.
 Note that you have been granted full administrator privileges in this assignment and can access all data without authentication.
-
-
-

src/main/resources/lessons/sqlinjection/documentation/SqlInjection_introduction_content3.adoc

@@ -21,4 +21,3 @@ If an attacker successfully "injects" DDL type SQL commands into a database, he
 ** This statement creates the employees example table given on page 2.
 
 Now try to modify the schema by adding the column "phone" (varchar(20)) to the table "employees". :
-

src/main/resources/lessons/sqlinjection/documentation/SqlInjection_introduction_content4.adoc

@@ -11,4 +11,3 @@ If an attacker successfully "injects" DCL type SQL commands into a database, he
 
 
 Try to grant rights to the table `grant_rights` to user `unauthorized_user`:
-

src/main/resources/lessons/sqlinjection/documentation/SqlInjection_introduction_plan.adoc

@@ -11,4 +11,3 @@ This lesson describes what Structured Query Language (SQL) is and how it can be
 ** String SQL injection
 ** Numeric SQL injection
 ** How SQL injection violates the CIA triad
-

src/main/resources/lessons/ssrf/documentation/SSRF_Prevent.adoc

@@ -8,4 +8,3 @@ To prevent SSRF vulnerabilities in web applications, it is recommended to adhere
 
 == References
 * https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
-

src/main/resources/lessons/vulnerablecomponents/documentation/VulnerableComponents_content0.adoc

@@ -10,4 +10,3 @@
 ** Some repositories allow you to remove published artifacts
 * Many different packaging systems; even for the same language
 * Different coordinates systems and level of granularity
-

src/main/resources/lessons/vulnerablecomponents/documentation/VulnerableComponents_content1a.adoc

@@ -8,4 +8,3 @@ WebGoat uses almost *200 Java and JavaScript* libraries.  Like most Java applica
 When this lesson was created WebGoat contained more than a dozen high security risks within it's components.  Most of these were not deliberate choices. How are developers supposed to track this information across the hundreds of components?
 
 image::images/WebGoat-Vulns.png[caption="Figure: ", title="WebGoat Security Issues", alt="Security Issues", width="800", height="400", style="lesson-image"]
-

src/main/resources/lessons/vulnerablecomponents/documentation/VulnerableComponents_content2.adoc

@@ -3,4 +3,3 @@ Below is an example of using the same WebGoat source code, but different version
 
 === jquery-ui:1.10.4
 This example allows the user to specify the content of the "closeText" for the jquery-ui dialog. This is an unlikely development scenario, however the jquery-ui dialog (TBD - show exploit link) does not defend against XSS in the button text of the close dialog.
-

src/main/resources/lessons/vulnerablecomponents/documentation/VulnerableComponents_content4.adoc

@@ -56,5 +56,3 @@ In the case of WebGoat, the plugin is activated when the following is run (owasp
 Below is a snippet of a report, which can be found in e.g. webgoat-container/target/dependency-check-report.html:
 
 image::images/OWASP-Dep-Check.png[caption="Figure: ", title="WebGoat Bill of Materials", alt="BoM", width="988", height="515", style="lesson-image"]
-
- 

src/main/resources/lessons/vulnerablecomponents/documentation/VulnerableComponents_content4a.adoc

@@ -20,4 +20,3 @@
 
 * It is not reasonable to expect a developer to continually research each component.
 * Developers are not security experts; they already have a day job.
-

src/main/resources/lessons/vulnerablecomponents/documentation/VulnerableComponents_content5.adoc

@@ -12,4 +12,3 @@ Ref: https://diniscruz.blogspot.com/2013/12/xstream-remote-code-execution-exploi
 https://github.com/pwntester/XStreamPOC[pwntester/XStreamPOC]
 
 You may want to read the article(s) before trying this lesson.  Let's see if you can figure out how to exploit this in WebGoat.
-

src/main/resources/lessons/vulnerablecomponents/documentation/VulnerableComponents_content6.adoc

@@ -12,5 +12,3 @@
 ** Use http://lmgtfy.com/?q=OSS+bill+of+materials[automated tooling]
 * Baseline open source consumption in your organization.
 * Develop an open source component risk management strategy to mitigate current risk and reduce future risk.
-
-

src/main/resources/lessons/vulnerablecomponents/documentation/VulnerableComponents_plan.adoc

@@ -13,4 +13,3 @@ image::images/OpenSourceGrowing2023.png[caption="Figure: ", title="The continued
 * Gain awareness that the open source consumed is as important as your own custom code.
 * Gain awareness of the management, or lack of management, in our open source component consumption.
 * Understand the importance of a Bill of Materials in determining open source component risk
-

src/main/resources/lessons/webwolfintroduction/documentation/Landing_page.adoc

@@ -21,4 +21,3 @@ The user enters a new password and hits enter. The new password will be sent to
 password will be sent to WebWolf. Try to locate the unique code.
 
 Please be aware that the user will receive an error page after resetting the password. In a real attack scenario the user would probably see a normal success page (this is due to a limit on what we can control with WebWolf)
-

src/main/resources/lessons/xss/documentation/CrossSiteScriptingMitigation_plan.adoc

@@ -8,6 +8,3 @@ you will know to learn how you can defend against it.
 * The user will understand the best practices for defending against XSS injection attacks
 * The user will demonstrate knowledge on:
 ** XSS mitigation
-
-
-

src/main/resources/lessons/xss/documentation/CrossSiteScripting_content5.adoc

@@ -6,4 +6,3 @@
 ** The script steals sensitive information, like the session id, and releases it to the attacker
 
 *Victim does not realize attack occurred*
-

src/main/resources/lessons/xss/documentation/CrossSiteScripting_content8a.adoc

@@ -38,7 +38,3 @@ it can run maliciously.
 |/  |\/|
 
 |===
-
-
-
-

src/main/resources/lessons/xss/documentation/CrossSiteScripting_content8b.adoc

@@ -63,6 +63,3 @@ http://hostname.com/mywebapp/main.jsp?first_name=<script>alert("XSS Test")</scri
 === It is your turn!
 
 Try to prevent this kind of XSS by escaping the URL parameters in the JSP file:
-
-
-

src/main/resources/lessons/xss/documentation/CrossSiteScripting_plan.adoc

@@ -9,6 +9,3 @@ This lesson describes what Cross-Site Scripting (XSS) is and how it can be used
 * The user will demonstrate knowledge on:
 ** Reflected XSS injection
 ** DOM-based XSS injection
-
-
-

src/main/resources/lessons/xxe/documentation/XXE_changing_content_type.adoc

@@ -3,4 +3,3 @@
 In modern REST frameworks the server might be able to accept data formats that you as a developer did not think about. So this might result in JSON endpoints being vulnerable to XXE attacks.
 
 Again same exercise but try to perform the same XML injection as we did in the first assignment.
-

src/main/resources/lessons/xxe/documentation/XXE_code.adoc

@@ -4,7 +4,7 @@ Now we know how the injection work, let's look at why this can happen. In Java a
 
 [source, java]
 ----
-public XmlMapper xmlMapper() {
+public XmlMapper xmlMapper() {
   return new XmlMapper(XMLInputFactory.newInstance()) // <1>
 }
 ----
@@ -19,12 +19,12 @@ This piece of code defines a new `XmlMapper` (`ObjectMapper`) which is a popular
 
 [source, java]
 ----
-/**
+/**
- * @since 2.4
+ * @since 2.4
- */
+ */
 public XmlMapper(XMLInputFactory inputF) {  // <1>
   this(new XmlFactory(inputF)); //<2>
-}
+}
 ----
 <1> This is the 'constructor' we called from the listing above (1)
 <2> Call to another 'constructor' and initialize a new instance of `XmlFactory`
@@ -38,10 +38,10 @@ public XmlFactory(XMLInputFactory xmlIn) { // <1>
 
 protected XmlFactory(XMLInputFactory xmlIn, XMLOutputFactory xmlOut, ...){ // <3>
   if (xmlIn == null) { //<4>
-    xmlIn = XMLInputFactory.newInstance();
+    xmlIn = XMLInputFactory.newInstance();
-    // as per [dataformat-xml#190], disable external entity expansion by default
+    // as per [dataformat-xml#190], disable external entity expansion by default
     xmlIn.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE); // <5>
-    // and ditto wrt [dataformat-xml#211], SUPPORT_DTD
+    // and ditto wrt [dataformat-xml#211], SUPPORT_DTD
     xmlIn.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);// <6>
   }
 }
@@ -55,15 +55,15 @@ If we look at the Spring Boot framework for example how they initialize the same
 
 [source, java]
 ----
-public ObjectMapper create() {				
+public ObjectMapper create() {
   return new XmlMapper(xmlInputFactory()); // <1>
-}
+}
 
-private static XMLInputFactory xmlInputFactory() {
+private static XMLInputFactory xmlInputFactory() {
-  XMLInputFactory inputFactory = XMLInputFactory.newInstance();
+  XMLInputFactory inputFactory = XMLInputFactory.newInstance();
-  inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+  inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
-  inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+  inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
-  return inputFactory;
+  return inputFactory;
 }
 ----
 <1> Call to a method which initializes the parser safely

src/main/resources/lessons/xxe/documentation/XXE_overflow.adoc

@@ -24,4 +24,3 @@ With the same XXE attack we can perform a DOS service attack towards the server.
 When XML parser loads this document, it sees that it includes one root element, "lolz", that contains the text "&lol9;". However, "&lol9;" is a defined entity that expands to a string containing ten "&lol8;" strings. Each "&lol8;" string is a defined entity that expands to ten "&lol7;" strings, and so on. After all the entity expansions have been processed, this small (< 1 KB) block of XML will actually take up almost 3 gigabytes of memory.
 
 This is called a "Billion laughs", more information can be found here: https://en.wikipedia.org/wiki/Billion_laughs
-

src/main/resources/lessons/xxe/documentation/XXE_static_code_analysis.adoc

@@ -15,7 +15,3 @@ SonarQube also shows you what you could do to fix this.
 image::images/xxe-suggested-fix.png[XXE suggested fix]
 
 If you click on the button below, you can try to do the XXE challenges again and you will notice that the vulnerabilities are mitigated.
-
-
-
-

src/main/resources/webgoat/static/js/application.js

@@ -177,5 +177,3 @@ var app = function() {
         sideBarLeftInit:sideBarLeftInit
     };
 }();
-
-

src/main/resources/webgoat/static/js/goatApp/model/LessonOverviewCollection.js

@@ -11,4 +11,3 @@ define([
 		model: AssignmentStatusModel
 	});
 });
-

src/main/resources/webgoat/static/js/goatApp/support/goatConstants.js

@@ -35,5 +35,3 @@ var goatConstants = {
 		}
 	}
 };
-
-

src/main/resources/webgoat/static/js/libs/ace.js

@@ -21632,4 +21632,3 @@ exports.version = "1.4.1";
                     }
                 });
             })();
-        

src/main/resources/webgoat/static/js/libs/mode-java.js

@@ -972,4 +972,3 @@ exports.Mode = Mode;
                         }
                     });
                 })();
-            

src/main/resources/webgoat/static/js/libs/theme-monokai.js

@@ -110,4 +110,3 @@ dom.importCssString(exports.cssText, exports.cssClass);
                         }
                     });
                 })();
-            

src/main/resources/webwolf/static/css/webwolf.css

@@ -90,4 +90,3 @@ hr { margin-top: 5px;margin-bottom: 10px; }
     padding: 5px 10px;
     font-size: smaller;
 }
-

src/test/java/org/owasp/webgoat/lessons/challenges/challenge7/MD5Test.java

@@ -24,6 +24,7 @@
 package org.owasp.webgoat.lessons.challenges.challenge7;
 
 import static org.assertj.core.api.Assertions.assertThat;
+
 import java.util.stream.Stream;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.params.ParameterizedTest;

src/test/java/org/owasp/webgoat/lessons/spoofcookie/encoders/EncDecTest.java

@@ -25,6 +25,7 @@ package org.owasp.webgoat.lessons.spoofcookie.encoders;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.MatcherAssert.assertThat;
+
 import java.util.stream.Stream;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;

src/test/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLessonTest.java

@@ -24,6 +24,7 @@ package org.owasp.webgoat.lessons.vulnerablecomponents;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+
 import com.thoughtworks.xstream.XStream;
 import com.thoughtworks.xstream.io.StreamException;
 import org.junit.jupiter.api.Disabled;

src/test/java/org/owasp/webgoat/webwolf/mailbox/MailboxRepositoryTest.java

@@ -23,6 +23,7 @@
 package org.owasp.webgoat.webwolf.mailbox;
 
 import static org.assertj.core.api.Assertions.assertThat;
+
 import java.time.LocalDateTime;
 import java.util.List;
 import org.junit.jupiter.api.Test;

src/test/java/org/owasp/webgoat/webwolf/user/UserServiceTest.java

@@ -62,7 +62,8 @@ public class UserServiceTest {
 
     when(mockUserRepository.findByUsername(username)).thenReturn(null);
 
-    assertThatExceptionOfType(UsernameNotFoundException.class).isThrownBy(() -> sut.loadUserByUsername(username));
+    assertThatExceptionOfType(UsernameNotFoundException.class)
+        .isThrownBy(() -> sut.loadUserByUsername(username));
   }
 
   @Test

src/test/resources/application-webwolf.properties

@@ -7,4 +7,3 @@ spring.jpa.properties.hibernate.default_schema=CONTAINER
 spring.thymeleaf.prefix=classpath:/webwolf/templates/
 
 webwolf.fileserver.location=${java.io.tmpdir}/webwolf-fileserver
-