First attempt at moving to Spring Boot 2

webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/Flag.java

@@ -5,7 +5,6 @@ import lombok.AllArgsConstructor;
 import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
 import org.owasp.webgoat.assignments.AttackResult;
-import org.owasp.webgoat.assignments.Endpoint;
 import org.owasp.webgoat.i18n.PluginMessages;
 import org.owasp.webgoat.session.WebSession;
 import org.owasp.webgoat.users.UserTracker;
@@ -27,7 +26,7 @@ import java.util.stream.IntStream;
  * @since 3/23/17.
  */
 @Slf4j
-public class Flag extends Endpoint {
+public class Flag { //extends Endpoint {
 
     public static final Map<Integer, String> FLAGS = Maps.newHashMap();
     @Autowired
@@ -48,10 +47,10 @@ public class Flag extends Endpoint {
         IntStream.range(1, 10).forEach(i -> FLAGS.put(i, UUID.randomUUID().toString()));
     }
 
-    @Override
-    public String getPath() {
-        return "challenge/flag";
-    }
+//    @Override
+//    public String getPath() {
+//        return "challenge/flag";
+//    }
 
     @RequestMapping(method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE)
     @ResponseBody

webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge1/Assignment1.java

@@ -63,6 +63,5 @@ public class Assignment1 extends AssignmentEndpoint {
 
     public static boolean containsHeader(HttpServletRequest request) {
         return StringUtils.hasText(request.getHeader("X-Forwarded-For"));
-
     }
 }

webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/Salaries.java

@@ -7,7 +7,6 @@ package org.owasp.webgoat.plugin;
 import com.google.common.collect.Lists;
 import com.google.common.collect.Maps;
 import lombok.SneakyThrows;
-import org.owasp.webgoat.assignments.Endpoint;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.util.FileCopyUtils;
@@ -30,7 +29,7 @@ import java.io.IOException;
 import java.util.List;
 import java.util.Map;
 
-public class Salaries extends Endpoint {
+public class Salaries { // {extends Endpoint {
 
     @Value("${webgoat.user.directory}")
     private String webGoatHomeDirectory;
@@ -84,10 +83,10 @@ public class Salaries extends Endpoint {
         return json;
     }
 
-    @Override
-    public String getPath() {
-        return "/clientSideFiltering/salaries";
-    }
+//    @Override
+//    public String getPath() {
+//        return "/clientSideFiltering/salaries";
+//    }
 
 
 }

webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFGetFlag.java

@@ -1,6 +1,5 @@
 package org.owasp.webgoat.plugin;
 
-import org.owasp.webgoat.assignments.Endpoint;
 import org.owasp.webgoat.i18n.PluginMessages;
 import org.owasp.webgoat.session.UserSessionData;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -20,7 +19,7 @@ import java.util.Random;
  * Created by jason on 9/30/17.
  */
 
-public class CSRFGetFlag extends Endpoint {
+public class CSRFGetFlag {
 
     @Autowired
     UserSessionData userSessionData;
@@ -71,9 +70,9 @@ public class CSRFGetFlag extends Endpoint {
         return response;
 
     }
-
-    @Override
-    public String getPath() {
-        return "/csrf/basic-get-flag";
-    }
+//
+//    @Override
+//    public String getPath() {
+//        return "/csrf/basic-get-flag";
+//    }
 }

webgoat-lessons/http-basics/src/main/java/org/owasp/webgoat/plugin/HttpBasicsLesson.java

@@ -4,10 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.assignments.AssignmentHints;
 import org.owasp.webgoat.assignments.AssignmentPath;
 import org.owasp.webgoat.assignments.AttackResult;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
 
 import java.io.IOException;
 
@@ -44,15 +41,14 @@ import java.io.IOException;
  * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
  * @created October 28, 2003
  */
-@AssignmentPath("/HttpBasics/attack1")
+@RestController
 @AssignmentHints({"http-basics.hints.http_basics_lesson.1"})
 public class HttpBasicsLesson extends AssignmentEndpoint {
 
-    @RequestMapping(method = RequestMethod.POST)
-    public
+    @PostMapping("/HttpBasics/attack1")
     @ResponseBody
-    AttackResult completed(@RequestParam String person) throws IOException {
-        if (!person.toString().equals("")) {
+    public AttackResult completed(@RequestParam String person) {
+        if (!person.equals("")) {
             return trackProgress(success()
                 .feedback("http-basics.reversed")
                 .feedbackArgs(new StringBuffer(person).reverse().toString())

webgoat-lessons/http-basics/src/main/java/org/owasp/webgoat/plugin/HttpBasicsQuiz.java

@@ -4,10 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.assignments.AssignmentHints;
 import org.owasp.webgoat.assignments.AssignmentPath;
 import org.owasp.webgoat.assignments.AttackResult;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
 
 import javax.servlet.http.HttpServletRequest;
 import java.io.IOException;
@@ -15,49 +12,51 @@ import java.io.IOException;
 /**
  * This file is part of WebGoat, an Open Web Application Security Project
  * utility. For details, please see http://www.owasp.org/
- *
+ * <p>
  * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
+ * <p>
  * This program is free software; you can redistribute it and/or modify it under
  * the terms of the GNU General Public License as published by the Free Software
  * Foundation; either version 2 of the License, or (at your option) any later
  * version.
- *
+ * <p>
  * This program is distributed in the hope that it will be useful, but WITHOUT
  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
  * details.
- *
+ * <p>
  * You should have received a copy of the GNU General Public License along with
  * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
  * Place - Suite 330, Boston, MA 02111-1307, USA.
- *
+ * <p>
  * Getting Source ==============
- *
+ * <p>
  * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
  * for free software projects.
- *
+ * <p>
  * For details, please see http://webgoat.github.io
  *
  * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
  * @created October 28, 2003
  */
-@AssignmentPath("/HttpBasics/attack2")
+@RestController
 @AssignmentHints({"http-basics.hints.http_basic_quiz.1", "http-basics.hints.http_basic_quiz.2"})
+@AssignmentPath("HttpBasics/attack2")
 public class HttpBasicsQuiz extends AssignmentEndpoint {
 
-	@RequestMapping(method = RequestMethod.POST)
-	public @ResponseBody AttackResult completed(@RequestParam String answer, @RequestParam String magic_answer, @RequestParam String magic_num, HttpServletRequest request) throws IOException {
+    @PostMapping("/HttpBasics/attack2")
+    @ResponseBody
+    public AttackResult completed(@RequestParam String answer, @RequestParam String magic_answer, @RequestParam String magic_num, HttpServletRequest request) throws IOException {
         if ("POST".equals(answer.toUpperCase()) && magic_answer.equals(magic_num)) {
-	        return trackProgress(success().build());
-	    } else {
-	    	if (!"POST".equals(answer.toUpperCase())) {
+            return trackProgress(success().build());
+        } else {
+            if (!"POST".equals(answer.toUpperCase())) {
                 return trackProgress(failed().feedback("http-basics.incorrect").build());
- 			}
-	    	if (!magic_answer.equals(magic_num)){
+            }
+            if (!magic_answer.equals(magic_num)) {
                 return trackProgress(failed().feedback("http-basics.magic").build());
-	    	}
-	    }
-	    return trackProgress(failed().build());
-	}
+            }
+        }
+        return trackProgress(failed().build());
+    }
 }

webgoat-lessons/idor/src/main/java/org/owasp/webgoat/plugin/IDORViewOwnProfile.java

@@ -1,7 +1,6 @@
 package org.owasp.webgoat.plugin;
 
 
-import org.owasp.webgoat.assignments.Endpoint;
 import org.owasp.webgoat.session.UserSessionData;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -12,7 +11,6 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
-
 import java.util.HashMap;
 import java.util.Map;
 
@@ -46,7 +44,7 @@ import java.util.Map;
  * @since January 3, 2017
  */
 
-public class IDORViewOwnProfile extends Endpoint{
+public class IDORViewOwnProfile {
 
     @Autowired
     UserSessionData userSessionData;
@@ -74,8 +72,8 @@ public class IDORViewOwnProfile extends Endpoint{
         return details;
     }
 
-    @Override
-    public String getPath() {
-        return "/IDOR/profile";
-    }
+//    @Override
+//    public String getPath() {
+//        return "/IDOR/profile";
+//    }
 }

webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/Users.java

@@ -1,6 +1,5 @@
 package org.owasp.webgoat.plugin;
 
-import org.owasp.webgoat.assignments.Endpoint;
 import org.owasp.webgoat.session.DatabaseUtilities;
 import org.owasp.webgoat.session.UserSessionData;
 import org.owasp.webgoat.session.WebSession;
@@ -13,7 +12,7 @@ import javax.servlet.http.HttpServletRequest;
 import java.sql.*;
 import java.util.HashMap;
 
-public class Users extends Endpoint{
+public class Users {
 
     @Autowired
     private WebSession webSession;
@@ -102,8 +101,8 @@ public class Users extends Endpoint{
         return webSession;
     }
 
-    @Override
-    public String getPath() {
-        return  "/access-control/list-users";
-    }
+//    @Override
+//    public String getPath() {
+//        return  "/access-control/list-users";
+//    }
 }

webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/Ping.java

@@ -1,7 +1,6 @@
 package org.owasp.webgoat.plugin;
 
 import lombok.extern.slf4j.Slf4j;
-import org.owasp.webgoat.assignments.Endpoint;
 import org.owasp.webgoat.session.WebSession;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
@@ -41,17 +40,17 @@ import java.io.PrintWriter;
  * @since November 17, 2016
  */
 @Slf4j
-public class Ping extends Endpoint {
+public class Ping  {
 
     @Value("${webgoat.user.directory}")
     private String webGoatHomeDirectory;
     @Autowired
     private WebSession webSession;
 
-    @Override
-    public String getPath() {
-        return "XXE/ping";
-    }
+//    @Override
+//    public String getPath() {
+//        return "XXE/ping";
+//    }
 
     @RequestMapping(method = RequestMethod.GET)
     @ResponseBody