diff --git a/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/CrossSiteScriptingLesson3.java b/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/CrossSiteScriptingLesson3.java index 92a56a38d..86bf80d6a 100644 --- a/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/CrossSiteScriptingLesson3.java +++ b/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/CrossSiteScriptingLesson3.java @@ -13,7 +13,7 @@ import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.ResponseBody; - +import java.io.IOException; import javax.tools.*; import java.io.IOException; @@ -30,37 +30,38 @@ public class CrossSiteScriptingLesson3 extends AssignmentEndpoint { @RequestMapping(method = RequestMethod.POST) @ResponseBody public AttackResult completed(@RequestParam String editor) { - //https://github.com/OWASP/owasp-java-encoder - //maybe better idea for assignment - // + String unescapedString = org.jsoup.parser.Parser.unescapeEntities(editor, true); + try { + if (editor.isEmpty()) return trackProgress(failed().feedback("xss-mitigation-3-no-code").build()); + Document doc = Jsoup.parse(unescapedString); + String[] lines = unescapedString.split(""); - Document doc = Jsoup.parse(editor); - String[] lines = editor.split(System.getProperty("line.separator")); + String include = (lines[0]); + String first_name_element = doc.select("body > table > tbody > tr:nth-child(1) > td:nth-child(2)").first().text(); + String last_name_element = doc.select("body > table > tbody > tr:nth-child(2) > td:nth-child(2)").first().text(); - String include = (lines[0]); - String first_name_element = doc.select("body > table > tbody > tr:nth-child(1) > td:nth-child(2)").first().text(); - String last_name_element = doc.select("body > table > tbody > tr:nth-child(2) > td:nth-child(2)").first().text(); + Boolean includeCorrect = false; + Boolean firstNameCorrect = false; + Boolean lastNameCorrect = false; - Boolean includeCorrect = false; - Boolean firstNameCorrect = false; - Boolean lastNameCorrect = false; - if(include.contains("<%@") && include.contains("taglib") && include.contains("uri=\"https://www.owasp.org/index.php/OWASP_Java_Encoder_Project\"") && include.contains("%>")){ - includeCorrect = true; - } - if(first_name_element.equals("${e:forHtml(param.first_name)}")){ - firstNameCorrect = true; - } - if(last_name_element.equals("${e:forHtml(param.last_name)}")){ - lastNameCorrect = true; - } + if (include.contains("<%@") && include.contains("taglib") && include.contains("uri=\"https://www.owasp.org/index.php/OWASP_Java_Encoder_Project\"") && include.contains("%>")) { + includeCorrect = true; + } + if (first_name_element.equals("${e:forHtml(param.first_name)}")) { + firstNameCorrect = true; + } + if (last_name_element.equals("${e:forHtml(param.last_name)}")) { + lastNameCorrect = true; + } - if(includeCorrect && firstNameCorrect && lastNameCorrect){ - System.out.println("true"); - return trackProgress(success().feedback("xss-mitigation-3-success").build()); - } else { - System.out.println("false"); - System.out.println(first_name_element + "\n" + last_name_element); - return trackProgress(failed().feedback("xss-mitigation-3-failure").build()); + if (includeCorrect && firstNameCorrect && lastNameCorrect) { + System.out.println("true"); + return trackProgress(success().feedback("xss-mitigation-3-success").build()); + } else { + return trackProgress(failed().feedback("xss-mitigation-3-failure").build()); + } + }catch(Exception e) { + return trackProgress(failed().output(e.getMessage()).build()); } } } diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScriptingMitigation.html b/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScriptingMitigation.html index 60d7abb2c..3c579a520 100644 --- a/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScriptingMitigation.html +++ b/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScriptingMitigation.html @@ -16,55 +16,26 @@
-
-
-
+
+
-
+
-
-
- + +
+
-
+
+
-
+
\ No newline at end of file diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/cross-site-scripting/src/main/resources/i18n/WebGoatLabels.properties index 10a40f8f8..0904492a0 100644 --- a/webgoat-lessons/cross-site-scripting/src/main/resources/i18n/WebGoatLabels.properties +++ b/webgoat-lessons/cross-site-scripting/src/main/resources/i18n/WebGoatLabels.properties @@ -35,4 +35,5 @@ xss-mitigation-3-hint2=Make use of JavaServer Pages Standard Tag Library (JSTL) xss-mitigation-3-hint3=Take a look at OWASP Java Encoder Project. xss-mitigation-3-hint4=Don't forget to reference the taglibs and choose "e" as prefix. xss-mitigation-3-success=You have completed this lesson. Congratulations! -xss-mitigation-3-failure=This in not the correct answer. Try again! \ No newline at end of file +xss-mitigation-3-failure=This in not the correct answer. Try again! +xss-mitigation-3-no-code=You didn't change anything. \ No newline at end of file diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/js/assignment3.js b/webgoat-lessons/cross-site-scripting/src/main/resources/js/assignment3.js index 053ff63d5..338d8ad2c 100644 --- a/webgoat-lessons/cross-site-scripting/src/main/resources/js/assignment3.js +++ b/webgoat-lessons/cross-site-scripting/src/main/resources/js/assignment3.js @@ -1,12 +1,50 @@ +$(document).ready( () => { + + var editor = ace.edit("editor"); + editor.setTheme("ace/theme/monokai"); + editor.session.setMode("ace/mode/html"); + + editor.getSession().on("change", () => { + setTimeout( () => { + $("#codesubmit input[name='editor']").val(ace_collect()); + }, 20); + }); + + editor.setValue("\n" + + "\n" + + " Using GET and POST Method to Read Form Data\n" + + "\n" + + "\n" + + "

Using POST Method to Read Form Data

\n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + "
First Name:YOUR CODE HERE
Last Name:YOUR CODE HERE
\n" + + "\n" + + "\n" + + "\n" + + "\n"); + +}); + + + function ace_collect() { let code = ""; - code = editor.getSession().getValue(); - $.ajax({ - type: "POST", - url: "/WebGoat/CrossSiteScripting/attack3", - dataType: "text", - data: { - editor: code - } + + $(".ace_xml").each(function(i, el) { + var to_add = el.innerHTML; + code += to_add; }); + console.log("+ "+editor.toString()); + console.log("code: "+code); + return code; } \ No newline at end of file