Moved Maven multiproject setup

webgoat-container/src/main/java/org/owasp/webgoat/service/ApplicationService.java

@@ -0,0 +1,59 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at
+ * https://github.com/WebGoat/WebGoat, a repository for free software projects.
+ *
+ * For details, please see http://webgoat.github.io
+ */
+package org.owasp.webgoat.service;
+
+import javax.servlet.http.HttpSession;
+import org.owasp.webgoat.application.Application;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class ApplicationService extends BaseService {
+
+    /**
+     * Returns global application info
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/application.mvc", produces = "application/json")
+    public @ResponseBody
+    Application showApplication(HttpSession session) {
+        Application app = Application.getInstance();
+        return app;
+    }
+
+}

webgoat-container/src/main/java/org/owasp/webgoat/service/BaseService.java

@@ -0,0 +1,88 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
+ * for free software projects.
+ *
+ * For details, please see http://webgoat.github.io
+ */
+package org.owasp.webgoat.service;
+
+import java.io.PrintWriter;
+import java.io.StringWriter;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
+import org.owasp.webgoat.session.WebSession;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.ResponseStatus;
+
+/**
+ *
+ * @author rlawson
+ */
+@RequestMapping("/service")
+public abstract class BaseService {
+
+    private static final Logger logger = LoggerFactory.getLogger(BaseService.class);
+
+    @ExceptionHandler(Exception.class)
+    @ResponseStatus(value = HttpStatus.I_AM_A_TEAPOT)
+    public @ResponseBody
+    ExceptionInfo handleException(HttpServletRequest request, Exception ex) {
+        String url = request.getRequestURL().toString();
+        logger.error("Exception handler for service caught exception when processing: " + url, ex);
+        ExceptionInfo response = new ExceptionInfo();
+        response.setUrl(url);
+        
+        response.setMessage(getStringStackTrace(ex));
+
+        return response;
+    }
+
+    public WebSession getWebSession(HttpSession session) {
+        WebSession ws;
+        Object o = session.getAttribute(WebSession.SESSION);
+        if (o == null) {
+            throw new IllegalArgumentException("No valid WebSession object found, has session timed out? [" + session.getId() + "]");
+        }
+        if (!(o instanceof WebSession)) {
+            throw new IllegalArgumentException("Invalid WebSession object found, this is probably a bug! [" + o.getClass() + " | " + session.getId() + "]");
+        }
+        ws = (WebSession) o;
+        return ws;
+    }
+
+    public String getStringStackTrace(Throwable t){
+        StringWriter sw = new StringWriter();
+        PrintWriter pw = new PrintWriter(sw);
+        t.printStackTrace(pw);
+        return sw.toString();
+    }
+}

webgoat-container/src/main/java/org/owasp/webgoat/service/CookieService.java

@@ -0,0 +1,83 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
+ * for free software projects.
+ *
+ * For details, please see http://webgoat.github.io
+ */
+package org.owasp.webgoat.service;
+
+import java.util.Collections;
+import java.util.List;
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpSession;
+import org.owasp.webgoat.lessons.model.RequestParameter;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.servlet.ModelAndView;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class CookieService extends BaseService {
+
+    /**
+     * Returns cookies for last attack
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/cookie.mvc", produces = "application/json")
+    public @ResponseBody
+    List<Cookie> showCookies(HttpSession session) {
+        WebSession ws = getWebSession(session);
+        List<Cookie> cookies = ws.getCookiesOnLastRequest();
+        return cookies;
+    }
+
+    /**
+     * Returns cookies and params for current lesson
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/cookies_widget.mvc", produces = "text/html")
+    public ModelAndView showCookiesAndParamsAsHtml(HttpSession session) {
+        ModelAndView model = new ModelAndView();
+        WebSession ws = getWebSession(session);
+        List<Cookie> cookies = ws.getCookiesOnLastRequest();
+        List<RequestParameter> listParms = ws.getParmsOnLastRequest();
+        Collections.sort(listParms);
+        model.addObject("wgcookies", cookies);
+        model.addObject("wgparams", listParms);
+        model.setViewName("widgets/cookies_and_params");
+        return model;
+    }
+}

webgoat-container/src/main/java/org/owasp/webgoat/service/DummyService.java

@@ -0,0 +1,51 @@
+/***************************************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ * 
+ * For details, please see http://webgoat.github.io
+ */
+package org.owasp.webgoat.service;
+
+import java.util.ArrayList;
+import java.util.List;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class DummyService extends BaseService{
+
+    @RequestMapping(value = "/first.mvc", produces = "application/json")
+    public @ResponseBody
+    List<String> firstNames() {
+        List<String> test = new ArrayList<String>();
+        test.add("one");
+        test.add("two)");
+        return test;
+    }
+}

webgoat-container/src/main/java/org/owasp/webgoat/service/ExceptionInfo.java

@@ -0,0 +1,54 @@
+/***************************************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ * 
+ * For details, please see http://webgoat.github.io
+ */
+package org.owasp.webgoat.service;
+
+/**
+ *
+ * @author rlawson
+ */
+public class ExceptionInfo {
+
+    private String url;
+    private String message;
+
+    public String getUrl() {
+        return url;
+    }
+
+    public void setUrl(String url) {
+        this.url = url;
+    }
+
+    public String getMessage() {
+        return message;
+    }
+
+    public void setMessage(String message) {
+        this.message = message;
+    }
+}

webgoat-container/src/main/java/org/owasp/webgoat/service/HintService.java

@@ -0,0 +1,86 @@
+/*
+ * To change this license header, choose License Headers in Project Properties.
+ * To change this template file, choose Tools | Templates
+ * and open the template in the editor.
+ */
+package org.owasp.webgoat.service;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.servlet.http.HttpSession;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.lessons.model.Hint;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.servlet.ModelAndView;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class HintService extends BaseService {
+
+    /**
+     * Returns hints for current lesson
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/hint.mvc", produces = "application/json")
+    public @ResponseBody
+    List<Hint> showHint(HttpSession session) {
+        List<Hint> listHints = new ArrayList<Hint>();
+        WebSession ws = getWebSession(session);
+        AbstractLesson l = ws.getCurrentLesson();
+        if (l == null) {
+            return listHints;
+        }
+        List<String> hints;
+        hints = l.getHintsPublic(ws);
+        if (hints == null) {
+            return listHints;
+        }
+        int idx = 0;
+        for (String h : hints) {
+            Hint hint = new Hint();
+            hint.setHint(h);
+            hint.setLesson(l.getName());
+            hint.setNumber(idx);
+            listHints.add(hint);
+            idx++;
+        }
+        return listHints;
+    }
+
+    @RequestMapping(value = "/hint_widget.mvc", produces = "text/html")
+    public
+            ModelAndView showHintsAsHtml(HttpSession session) {
+        ModelAndView model = new ModelAndView();
+        List<Hint> listHints = new ArrayList<Hint>();
+        model.addObject("hints", listHints);
+        WebSession ws = getWebSession(session);
+        AbstractLesson l = ws.getCurrentLesson();
+        if (l == null) {            
+            return model;
+        }
+        List<String> hints;
+        hints = l.getHintsPublic(ws);
+        if (hints == null) {
+            return model;
+        }
+        int idx = 0;
+        for (String h : hints) {
+            Hint hint = new Hint();
+            hint.setHint(h);
+            hint.setLesson(l.getName());
+            hint.setNumber(idx);
+            listHints.add(hint);
+            idx++;
+        }
+        model.setViewName("widgets/hints");
+        return model;
+    }
+}

webgoat-container/src/main/java/org/owasp/webgoat/service/LessonMenuService.java

@@ -0,0 +1,133 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at
+ * https://github.com/WebGoat/WebGoat, a repository for free software projects.
+ *
+ * For details, please see http://webgoat.github.io
+ */
+package org.owasp.webgoat.service;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.servlet.http.HttpSession;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.lessons.Category;
+import org.owasp.webgoat.lessons.RandomLessonAdapter;
+import org.owasp.webgoat.lessons.model.LessonMenuItem;
+import org.owasp.webgoat.lessons.model.LessonMenuItemType;
+import org.owasp.webgoat.session.Course;
+import org.owasp.webgoat.session.WebSession;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class LessonMenuService extends BaseService {
+
+    private static final Logger logger = LoggerFactory.getLogger(LessonMenuService.class);
+
+    /**
+     * Returns the lesson menu which is used to build the left nav
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/lessonmenu.mvc", produces = "application/json")
+    public @ResponseBody
+    List<LessonMenuItem> showLeftNav(HttpSession session) {
+        List<LessonMenuItem> menu = new ArrayList<LessonMenuItem>();
+        WebSession ws = getWebSession(session);
+        // Get the categories, these are the main menu items
+        Course course = ws.getCourse();
+        List<Category> categories = course.getCategories();
+
+        for (Category category : categories) {
+            LessonMenuItem categoryItem = new LessonMenuItem();
+            categoryItem.setName(category.getName());
+            categoryItem.setType(LessonMenuItemType.CATEGORY);
+            // check for any lessons for this category
+            List<AbstractLesson> lessons = ws.getLessons(category);
+            String role = ws.getRole();
+            logger.info("Role: " + role);
+            for (AbstractLesson lesson : lessons) {
+                LessonMenuItem lessonItem = new LessonMenuItem();
+                lessonItem.setName(lesson.getTitle());
+                lessonItem.setLink(lesson.getLink());
+                lessonItem.setType(LessonMenuItemType.LESSON);
+                if (lesson.isCompleted(ws)) {
+                    lessonItem.setComplete(true);
+                }
+                /* @TODO - do this in a more efficient way 
+                 if (lesson.isAuthorized(ws, role, WebSession.SHOWHINTS)) {
+                 lessonItem.setShowHints(true);
+                 }
+
+                 if (lesson.isAuthorized(ws, role, WebSession.SHOWSOURCE)) {
+                 lessonItem.setShowSource(true);
+                 }
+                 */
+                // special handling for challenge role
+                if (Category.CHALLENGE.equals(lesson.getCategory())) {
+                    lessonItem.setShowHints(lesson.isAuthorized(ws, AbstractLesson.CHALLENGE_ROLE, WebSession.SHOWHINTS));
+                    lessonItem.setShowSource(lesson.isAuthorized(ws, AbstractLesson.CHALLENGE_ROLE, WebSession.SHOWHINTS));
+                }
+
+                categoryItem.addChild(lessonItem);
+                // Does the lesson have stages
+                if (lesson instanceof RandomLessonAdapter) {
+                    RandomLessonAdapter rla = (RandomLessonAdapter) lesson;
+                    String[] stages = rla.getStages();
+                    if (stages != null) {
+                        String lessonLink = lesson.getLink();
+                        int stageIdx = 1;
+                        for (String stage : stages) {
+                            LessonMenuItem stageItem = new LessonMenuItem();
+                            stageItem.setName("Stage " + stageIdx + ": " + stage);
+                            // build the link for the stage
+                            String stageLink = lessonLink + "&stage=" + stageIdx;
+                            stageItem.setLink(stageLink);
+                            stageItem.setType(LessonMenuItemType.STAGE);
+                            if (rla.isStageComplete(ws, stage)) {
+                                stageItem.setComplete(true);
+                            }
+                            lessonItem.addChild(stageItem);
+                            stageIdx++;
+                        }
+                    }
+                }
+            }
+            menu.add(categoryItem);
+        }
+        return menu;
+
+    }
+}

webgoat-container/src/main/java/org/owasp/webgoat/service/LessonPlanService.java

@@ -0,0 +1,93 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
+ * for free software projects.
+ *
+ * For details, please see http://webgoat.github.io
+ */
+package org.owasp.webgoat.service;
+
+import javax.servlet.http.HttpSession;
+import static org.owasp.webgoat.LessonSource.END_SOURCE_SKIP;
+import static org.owasp.webgoat.LessonSource.START_SOURCE_SKIP;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.lessons.model.SourceListing;
+import org.owasp.webgoat.session.Course;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class LessonPlanService extends BaseService {
+
+    /**
+     * Returns source for current attack
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/lessonplan.mvc", produces = "application/html")
+    public @ResponseBody
+    String showPlan(HttpSession session) {
+        WebSession ws = getWebSession(session);
+        String plan = getPlan(ws);
+        return plan;
+        //SourceListing sl = new SourceListing();
+        //sl.setSource(source);
+        //return sl;
+    }
+
+    /**
+     * Description of the Method
+     *
+     * @param s Description of the Parameter
+     * @return Description of the Return Value
+     */
+    protected String getPlan(WebSession s) {
+
+        String plan = null;
+        int scr = s.getCurrentScreen();
+        Course course = s.getCourse();
+
+        if (s.isUser() || s.isChallenge()) {
+
+            AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
+
+            if (lesson != null) {
+                plan = lesson.getLessonPlan(s);
+            }
+        }
+        if (plan == null) {
+            plan = "Plan is not available for this lesson.";
+        }
+        return plan;
+    }
+}

webgoat-container/src/main/java/org/owasp/webgoat/service/LessonTitleService.java

@@ -0,0 +1,40 @@
+package org.owasp.webgoat.service;
+
+import javax.servlet.http.HttpSession;
+
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.session.Course;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+@Controller
+public class LessonTitleService extends BaseService {
+	
+	 /**
+     * Returns the title for the current attack
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/lessontitle.mvc", produces = "application/html")
+    public @ResponseBody
+    String showPlan(HttpSession session) {
+        WebSession ws = getWebSession(session);
+        return getLessonTitle(ws);
+    }
+
+    private String getLessonTitle(WebSession s) {
+    	String title = "";
+        int scr = s.getCurrentScreen();
+        Course course = s.getCourse();
+
+        if (s.isUser() || s.isChallenge()) {
+            AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
+            title = lesson != null ? lesson.getTitle() : "";
+        }
+        return title;
+    }
+
+}

webgoat-container/src/main/java/org/owasp/webgoat/service/ParameterService.java

@@ -0,0 +1,68 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
+ * for free software projects.
+ *
+ * For details, please see http://webgoat.github.io
+ */
+package org.owasp.webgoat.service;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import javax.servlet.http.HttpSession;
+import org.owasp.webgoat.lessons.model.RequestParameter;
+import org.owasp.webgoat.session.WebSession;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class ParameterService extends BaseService {
+
+    final Logger logger = LoggerFactory.getLogger(ParameterService.class);
+
+    /**
+     * Returns request parameters for last attack
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/parameter.mvc", produces = "application/json")
+    public @ResponseBody
+    List<RequestParameter> showParameters(HttpSession session) {
+        WebSession ws = getWebSession(session);
+        List<RequestParameter> listParms = ws.getParmsOnLastRequest();
+        Collections.sort(listParms);
+        return listParms;
+    }
+}

webgoat-container/src/main/java/org/owasp/webgoat/service/RestartLessonService.java

@@ -0,0 +1,59 @@
+/***************************************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ * 
+ * For details, please see http://webgoat.github.io
+ */
+package org.owasp.webgoat.service;
+
+import javax.servlet.http.HttpSession;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class RestartLessonService extends BaseService {
+
+    /**
+     * Returns current lesson
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/restartlesson.mvc", produces = "text/text")
+    public @ResponseBody
+    String restartLesson(HttpSession session) {
+        WebSession ws = getWebSession(session);
+        int currentScreen = ws.getCurrentScreen();
+        if(currentScreen > 0){
+            ws.restartLesson(currentScreen);
+        }
+        return ws.getCurrentLesson().getLink();
+    }
+}

webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java

@@ -0,0 +1,57 @@
+/*
+ * To change this license header, choose License Headers in Project Properties.
+ * To change this template file, choose Tools | Templates
+ * and open the template in the editor.
+ */
+package org.owasp.webgoat.service;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Date;
+import java.util.Enumeration;
+import java.util.List;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class SessionService extends BaseService {
+
+    /**
+     * Returns hints for current lesson
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/session.mvc", produces = "application/json")
+    public @ResponseBody
+    String showSession(HttpServletRequest request, HttpSession session) {
+        StringBuilder sb = new StringBuilder();
+        sb.append("id").append(" = ").append(session.getId()).append("\n");
+        sb.append("created").append(" = ").append(new Date(session.getCreationTime())).append("\n");
+        sb.append("last access").append(" = ").append(new Date(session.getLastAccessedTime())).append("\n");
+        sb.append("timeout (secs)").append(" = ").append(session.getMaxInactiveInterval()).append("\n");
+        sb.append("session from cookie?").append(" = ").append(request.isRequestedSessionIdFromCookie()).append("\n");
+        sb.append("session from url?").append(" = ").append(request.isRequestedSessionIdFromURL()).append("\n");
+        sb.append("=====================================\n");
+        // get attributes
+        List<String> attributes = new ArrayList<String>();
+        Enumeration keys = session.getAttributeNames();
+        while (keys.hasMoreElements()) {
+            String name = (String) keys.nextElement();
+            attributes.add(name);
+        }
+        Collections.sort(attributes);
+        for (String attribute : attributes) {
+            String value = session.getAttribute(attribute) + "";
+            sb.append(attribute).append(" = ").append(value).append("\n");
+        }
+        return sb.toString();
+    }
+}

webgoat-container/src/main/java/org/owasp/webgoat/service/SolutionService.java

@@ -0,0 +1,82 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
+ * for free software projects.
+ *
+ * For details, please see http://webgoat.github.io
+ */
+package org.owasp.webgoat.service;
+
+import javax.servlet.http.HttpSession;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.session.Course;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class SolutionService extends BaseService {
+
+    /**
+     * Returns solution for current attack
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/solution.mvc", produces = "text/html")
+    public @ResponseBody
+    String showSolution(HttpSession session) {
+        WebSession ws = getWebSession(session);
+        String source = getSolution(ws);
+        return source;
+    }
+
+    protected String getSolution(WebSession s) {
+
+        String source = null;
+        int scr = s.getCurrentScreen();
+        Course course = s.getCourse();
+
+        if (s.isUser() || s.isChallenge()) {
+
+            AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
+
+            if (lesson != null) {
+                source = lesson.getSolution(s);
+            }
+        }
+        if (source == null) {
+            return "Solution  is not available. Contact "
+                    + s.getWebgoatContext().getFeedbackAddressHTML();
+        }
+        return (source);
+    }
+}

webgoat-container/src/main/java/org/owasp/webgoat/service/SourceService.java

@@ -0,0 +1,96 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
+ * for free software projects.
+ *
+ * For details, please see http://webgoat.github.io
+ */
+package org.owasp.webgoat.service;
+
+import javax.servlet.http.HttpSession;
+import static org.owasp.webgoat.LessonSource.END_SOURCE_SKIP;
+import static org.owasp.webgoat.LessonSource.START_SOURCE_SKIP;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.session.Course;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class SourceService extends BaseService {
+
+    /**
+     * Returns source for current attack
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/source.mvc", produces = "application/text")
+    public @ResponseBody
+    String showSource(HttpSession session) {
+        WebSession ws = getWebSession(session);
+        String source = getSource(ws);
+        if (source == null) {
+            source = "No source listing found";
+        }
+        return source;
+        //SourceListing sl = new SourceListing();
+        //sl.setSource(source);
+        //return sl;
+    }
+
+    /**
+     * Description of the Method
+     *
+     * @param s Description of the Parameter
+     * @return Description of the Return Value
+     */
+    protected String getSource(WebSession s) {
+
+        String source = null;
+        int scr = s.getCurrentScreen();
+        Course course = s.getCourse();
+
+        if (s.isUser() || s.isChallenge()) {
+
+            AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
+
+            if (lesson != null) {
+                source = lesson.getRawSource(s);
+            }
+        }
+        if (source == null) {
+            return "Source code is not available for this lesson.";
+        }
+        return (source.replaceAll("(?s)" + START_SOURCE_SKIP + ".*" + END_SOURCE_SKIP,
+                "Code Section Deliberately Omitted"));
+    }
+}