dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

isEncoded and isNotEncoded Unit Tests added

Browse Source
This commit is contained in:
Jason White 2017-05-25 19:36:02 -04:00
parent 31548b9c57
commit 2305d355c7
1 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
webgoat-lessons/cross-site-scripting/src/test/java/org/owasp/webgoat/plugin/StoredXssCommentsTest.java
View File

@ -74,15 +74,25 @@ public class StoredXssCommentsTest extends AssignmentEndpointTest {
results.andExpect(jsonPath("$.lessonCompleted",CoreMatchers.is(false))); results.andExpect(jsonPath("$.lessonCompleted",CoreMatchers.is(false)));
} }
/* For the next two tests there is a comment seeded ...
comments.add(new Comment("secUriTy", DateTime.now().toString(fmt), "<script>console.warn('unit test me')</script>Comment for Unit Testing"));
... the isEncoded method will remain commented out as it will fail (because WebGoat isn't supposed to be secure)
*/
//Ensures it is vulnerable
@Test @Test
public void isNotEncoded() { public void isNotEncoded() throws Exception {
assert true; //do get to get comments after posting xss payload
//TODO: get around to this ResultActions taintedResults = mockMvc.perform(MockMvcRequestBuilders.get("/CrossSiteScripting/stored-xss"));
taintedResults.andExpect(jsonPath("$[0].text",CoreMatchers.is(CoreMatchers.containsString("<script>console.warn('unit test me')</script>"))));
} }
@Test
public void isEncoded() { //Could be used to test an encoding solution ... commented out so build will pass. Uncommenting will fail build, but leaving in as positive Security Unit Test
assert true; // @Test
//TODO: get around to this // public void isEncoded() throws Exception {
} // //do get to get comments after posting xss payload
// ResultActions taintedResults = mockMvc.perform(MockMvcRequestBuilders.get("/CrossSiteScripting/stored-xss"));
// taintedResults.andExpect(jsonPath("$[0].text",CoreMatchers.is(CoreMatchers.containsString("&lt;scriptgt;"))));
// }
} }