From 2334b3c02dfebbca3fa3e4de943b989a88b4e68f Mon Sep 17 00:00:00 2001 From: Max Geldner Date: Tue, 30 Oct 2018 11:49:21 +0100 Subject: [PATCH] lessons: sql_injection added another assignment --- .../mitigation/SqlInjectionLesson10b.java | 85 +++++++++++++++++++ .../html/SqlInjectionMitigations.html | 19 +++++ .../en/SqlInjection_jdbc_newcode.adoc | 43 ++++++++++ 3 files changed, 147 insertions(+) create mode 100644 webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java create mode 100644 webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_jdbc_newcode.adoc diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java new file mode 100644 index 000000000..acd69175b --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java @@ -0,0 +1,85 @@ +package org.owasp.webgoat.plugin.mitigation; + +import lombok.SneakyThrows; +import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentPath; +import org.owasp.webgoat.assignments.AttackResult; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.ResponseBody; + +import javax.tools.*; +import java.io.IOException; +import java.net.URI; +import java.util.Arrays; +import java.util.List; +import java.util.regex.Matcher; +import java.util.regex.Pattern; + +@AssignmentPath("SqlInjection/attack10b") +public class SqlInjectionLesson10b extends AssignmentEndpoint { + + @RequestMapping(method = RequestMethod.POST) + @ResponseBody + public AttackResult completed(@RequestParam String code) { + String regex1 = "(?=.*PreparedStatement.*)(?=.*setString.*)(?=.*\\=\\?.*|.*\\=\\s\\?.*)"; + boolean hasImportant = this.check_text(regex1, code.replace("\n", "").replace("\r", "")); + List hasCompiled = this.compileFromString(code); + String errors = ""; + if(hasImportant && hasCompiled.size() < 2) { + return trackProgress(success().build()); + } else if(hasCompiled.size() > 1) { + for(Diagnostic d : hasCompiled) { + errors += d.getMessage(null) + "\n"; + } + } + return trackProgress(failed().output(errors).build()); + } + + private List compileFromString(String s) { + JavaCompiler compiler = ToolProvider.getSystemJavaCompiler(); + DiagnosticCollector diagnosticsCollector = new DiagnosticCollector(); + StandardJavaFileManager fileManager = compiler.getStandardFileManager(diagnosticsCollector, null, null); + JavaFileObject javaObjectFromString = getJavaFileContentsAsString(s); + Iterable fileObjects = Arrays.asList(javaObjectFromString); + JavaCompiler.CompilationTask task = compiler.getTask(null, fileManager, diagnosticsCollector, null, null, fileObjects); + Boolean result = task.call(); + List diagnostics = diagnosticsCollector.getDiagnostics(); + if(result == true){ + return null; + } else { + return diagnostics; + } + } + + private SimpleJavaFileObject getJavaFileContentsAsString(String s){ + StringBuilder javaFileContents = new StringBuilder("import java.sql.*; public class TestClass { public static void main(String[] args) {" + s + "}}"); + JavaObjectFromString javaFileObject = null; + try{ + javaFileObject = new JavaObjectFromString("TestClass.java", javaFileContents.toString()); + }catch(Exception exception){ + exception.printStackTrace(); + } + return javaFileObject; + } + + class JavaObjectFromString extends SimpleJavaFileObject { + private String contents = null; + public JavaObjectFromString(String className, String contents) throws Exception{ + super(new URI(className), Kind.SOURCE); + this.contents = contents; + } + public CharSequence getCharContent(boolean ignoreEncodingErrors) throws IOException { + return contents; + } + } + + private boolean check_text(String regex, String text) { + Pattern p = Pattern.compile(regex, Pattern.CASE_INSENSITIVE); + Matcher m = p.matcher(text); + if(m.find()) + return true; + else return false; + } +} diff --git a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html index d618b50c9..986f178ab 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html +++ b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html @@ -35,6 +35,25 @@ +
+
+ + +
+
+
+
+
+
+ +
+
+ +
+
+
+
+
diff --git a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_jdbc_newcode.adoc b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_jdbc_newcode.adoc new file mode 100644 index 000000000..0530541ed --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_jdbc_newcode.adoc @@ -0,0 +1,43 @@ +== Try it! Writing safe code + +Now it's time to write your own code! + +All code you write down below gets inserted into a main method of a java class with the name "TestClass". This class also imports java.sql.*. Use your knowledge and write the right code from scratch! + +[source,java] +------------------------------------------------------- + Connection conn = null; + PreparedStatement stmt = null; + try{ + //STEP 1: Open a connection + conn = DriverManager.getConnection("DBURL","DBUSER","DBPW"); + + //STEP 2: Use the PreparedStatement + stmt = conn.prepareStatement("SELECT id, first, last, age FROM Employees WHERE id=?"); + stmt.setString(1, "Hallo"); + + //STEP 3: Clean-up environment + stmt.close(); + conn.close(); + //STEP 4: catch Exceptions + }catch(SQLException se){ + //Handle errors for JDBC + se.printStackTrace(); + }catch(Exception e){ + //Handle errors for Class.forName + e.printStackTrace(); + }finally{ + //finally block used to close resources + try{ + if(stmt!=null) + stmt.close(); + }catch(SQLException se2){ + }// nothing we can do + try{ + if(conn!=null) + conn.close(); + }catch(SQLException se){ + se.printStackTrace(); + }//end finally try + }//end try +-------------------------------------------------------