");
-
- if (results.next()) {
- for (int i = 1; i < (numColumns + 1); i++) {
- t.append(resultsMetaData.getColumnName(i));
- t.append(", ");
- }
-
- t.append("
");
- results.beforeFirst();
-
- while (results.next()) {
-
- for (int i = 1; i < (numColumns + 1); i++) {
- t.append(results.getString(i));
- t.append(", ");
- }
-
- t.append("
");
- }
-
- } else {
- t.append("Query Successful; however no data was returned from this query.");
- }
-
- t.append("
USERID, FIRST_NAME"))); + .andExpect(jsonPath("$.feedback", is(this.modifySpan(messages.getMessage("sql-injection.8.one"))))) + .andExpect(jsonPath("$.output", containsString("
| "))); } @Test - public void unknownAccount() throws Exception { - mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack5a") - .param("account", "Smithh")) - - .andExpect(status().isOk()) - .andExpect(jsonPath("lessonCompleted", is(false))) - .andExpect(jsonPath("$.feedback", is(messages.getMessage("NoResultsMatched")))) - .andExpect(jsonPath("$.output").doesNotExist()); - } - - @Test - public void sqlInjection() throws Exception { - mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack5a") - .param("account", "smith' OR '1' = '1")) + public void multipleAccounts() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack8") + .param("name", "Smith") + .param("auth_tan", "3SL99A' OR '1' = '1")) .andExpect(status().isOk()) .andExpect(jsonPath("lessonCompleted", is(true))) - .andExpect(jsonPath("$.feedback", containsString("You have succeeded"))) + .andExpect(jsonPath("$.feedback", is(this.modifySpan(messages.getMessage("sql-injection.8.success"))))) + .andExpect(jsonPath("$.output", containsString(" | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 96134<\\/td> | Bob<\\/td> | Franco<\\/td> | Marketing<\\/td> | 83700<\\/td> | LO9S2V<\\/td><\\/tr>")));
+ }
+
+ @Test
+ public void wrongNameReturnsNoAccounts() throws Exception {
+ mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack8")
+ .param("name", "Smithh")
+ .param("auth_tan", "3SL99A"))
+
+ .andExpect(status().isOk())
+ .andExpect(jsonPath("lessonCompleted", is(false)))
+ .andExpect(jsonPath("$.feedback", is(this.modifySpan(messages.getMessage("sql-injection.8.no.results")))))
.andExpect(jsonPath("$.output").doesNotExist());
}
@Test
- public void sqlInjectionWrongShouldDisplayError() throws Exception {
- mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack5a")
- .param("account", "smith' OR '1' = '1'"))
+ public void wrongTANReturnsNoAccounts() throws Exception {
+ mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack8")
+ .param("name", "Smithh")
+ .param("auth_tan", ""))
.andExpect(status().isOk())
.andExpect(jsonPath("lessonCompleted", is(false)))
- .andExpect(jsonPath("$.feedback", containsString(messages.getMessage("assignment.not.solved"))))
- .andExpect(jsonPath("$.output", is("malformed string: '1''")));
+ .andExpect(jsonPath("$.feedback", is(this.modifySpan(messages.getMessage("sql-injection.8.no.results")))))
+ .andExpect(jsonPath("$.output").doesNotExist());
+ }
+
+ @Test
+ public void malformedQueryReturnsError() throws Exception {
+ mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack8")
+ .param("name", "Smith")
+ .param("auth_tan", "3SL99A' OR '1' = '1'"))
+
+ .andExpect(status().isOk())
+ .andExpect(jsonPath("lessonCompleted", is(false)))
+ .andExpect(jsonPath("$.feedback", is(this.modifySpan(messages.getMessage("sql-injection.error")))))
+ .andExpect(jsonPath("$.output", containsString("feedback-negative")));
+ }
+
+ private String modifySpan(String message) {
+ return message.replace("", "<\\/span>");
}
}
diff --git a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson9Test.java b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson9Test.java
new file mode 100644
index 000000000..5e81a26b7
--- /dev/null
+++ b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson9Test.java
@@ -0,0 +1,179 @@
+package org.owasp.webgoat.plugin.introduction;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.owasp.webgoat.plugins.LessonTest;
+import org.owasp.webgoat.session.WebgoatContext;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.CoreMatchers.is;
+import static org.mockito.Mockito.when;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+/**
+ * @author Benedikt Stuhrmann
+ * @since 11/07/18.
+ */
+@RunWith(SpringJUnit4ClassRunner.class)
+public class SqlInjectionLesson9Test extends LessonTest {
+
+ @Autowired
+ private WebgoatContext context;
+
+ private String completedError = "JSON path \"lessonCompleted\"";
+
+ @Before
+ public void setup() {
+ SqlInjection sql = new SqlInjection();
+ when(webSession.getCurrentLesson()).thenReturn(sql);
+ when(webSession.getWebgoatContext()).thenReturn(context);
+ this.mockMvc = MockMvcBuilders.webAppContextSetup(this.wac).build();
+ }
+
+ @Test
+ public void oneAccount() throws Exception {
+ try {
+ mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack9")
+ .param("name", "Smith")
+ .param("auth_tan", "3SL99A"))
+
+ .andExpect(status().isOk())
+ .andExpect(jsonPath("lessonCompleted", is(false)))
+ .andExpect(jsonPath("$.feedback", is(this.modifySpan(messages.getMessage("sql-injection.9.one")))))
+ .andExpect(jsonPath("$.output", containsString("
|