diff --git a/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/bypass_restrictions/BypassRestrictionsFieldRestrictions.java b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/bypass_restrictions/BypassRestrictionsFieldRestrictions.java index 6de74feed..55acae9fd 100644 --- a/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/bypass_restrictions/BypassRestrictionsFieldRestrictions.java +++ b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/bypass_restrictions/BypassRestrictionsFieldRestrictions.java @@ -34,7 +34,7 @@ public class BypassRestrictionsFieldRestrictions extends AssignmentEndpoint { @PostMapping("/BypassRestrictions/FieldRestrictions") @ResponseBody - public AttackResult completed(@RequestParam String select, @RequestParam String radio, @RequestParam String checkbox, @RequestParam String shortInput) { + public AttackResult completed(@RequestParam String select, @RequestParam String radio, @RequestParam String checkbox, @RequestParam String shortInput, @RequestParam String readOnlyInput) { if (select.equals("option1") || select.equals("option2")) { return failed(this).build(); } @@ -47,6 +47,9 @@ public class BypassRestrictionsFieldRestrictions extends AssignmentEndpoint { if (shortInput.length() <= 5) { return failed(this).build(); } + if ("change".equals(readOnlyInput)) { + return failed(this).build(); + } return success(this).build(); } } diff --git a/webgoat-lessons/bypass-restrictions/src/main/resources/css/bypass-restrictions.css b/webgoat-lessons/bypass-restrictions/src/main/resources/css/bypass-restrictions.css new file mode 100644 index 000000000..4572fa24a --- /dev/null +++ b/webgoat-lessons/bypass-restrictions/src/main/resources/css/bypass-restrictions.css @@ -0,0 +1,5 @@ +.bypass-input-container { + position: relative; + padding: 7px; + margin-top: 7px; +} \ No newline at end of file diff --git a/webgoat-lessons/bypass-restrictions/src/main/resources/html/BypassRestrictions.html b/webgoat-lessons/bypass-restrictions/src/main/resources/html/BypassRestrictions.html index 06ef097db..38eadc4f3 100755 --- a/webgoat-lessons/bypass-restrictions/src/main/resources/html/BypassRestrictions.html +++ b/webgoat-lessons/bypass-restrictions/src/main/resources/html/BypassRestrictions.html @@ -1,124 +1,167 @@ - + -
- - -
-
+
+ + +
+
-
- -
-
-
+
+ +
+ +
+
+
-
Select field with two possible values
- -
Radio button with two possible values
- Option 1
- Option 2
-
Checkbox: value either on or off
- Checkbox -
Input restricted to max 5 characters
- -
Disabled input field
- - +
Select field with two possible value +
+ +
+
+
Radio button with two possible values +
+ Option 1
+ Option 2
+
+
+
Checkbox: value either on or off +
+ Checkbox +
+
+
Input restricted to max 5 characters +
+
+
+
Readonly input field +
+ +
+
+
+
-
-
+
+
+
+
-
-
-
-
+
+
+
+
-
-
- Field 1: exactly three lowercase characters(^[a-z]{3}$) -
-
- -
-

-
Field 2: exactly three digits(^[0-9]{3}$)
-
- -
-

-
Field 3: letters, numbers, and space only(^[a-zA-Z0-9 ]*$)
-
- -
-

-
Field 4: enumeration of numbers (^(one|two|three|four|five|six|seven|eight|nine)$)
-
- -
-

-
Field 5: simple zip code (^\d{5}$)
-
- -
-

-
Field 6: zip with optional dash four (^\d{5}(-\d{4})?$)
-
- -
-

-
Field 7: US phone number with or without dashes (^[2-9]\d{2}-?\d{3}-?\d{4}$)
-
- -
- -

-
+
+
+ Field 1: exactly three lowercase characters(^[a-z]{3}$) +
+
+ +
+

+
Field 2: exactly three digits(^[0-9]{3}$)
+
+ +
+

+
Field 3: letters, numbers, and space only(^[a-zA-Z0-9 ]*$)
+
+ +
+

+
Field 4: enumeration of numbers (^(one|two|three|four|five|six|seven|eight|nine)$) +
+
+ +
+

+
Field 5: simple zip code (^\d{5}$)
+
+ +
+

+
Field 6: zip with optional dash four (^\d{5}(-\d{4})?$)
+
+ +
+

+
Field 7: US phone number with or without dashes (^[2-9]\d{2}-?\d{3}-?\d{4}$)
+
+ +
+ +

+ +

+
- -
-
-
-
-
+ +
+
+
+
+