XXE successfully completed message was no longer shown, fixed it by using form POST together with customjs functions.

Introduced callback functionality which you can specify after the posting in order to be able to load the comments list again.
This commit is contained in:
Nanne Baars
2017-06-12 15:08:55 +02:00
parent 19a4859e4f
commit 52a48df70c
5 changed files with 26 additions and 27 deletions

View File

@ -1,23 +1,17 @@
webgoat.customjs.simpleXXE = function () {
var commentInput = $("#commentInputSimple").val();
var xml = '<?xml version="1.0"?>' +
'<comment>' +
' <text>' + commentInput + '</text>' +
'</comment>';
return xml;
}
webgoat.customjs.simpleXXECallback = function() {
getComments('#commentsListSimple');
}
$(document).ready(function () {
$("#postCommentSimple").unbind();
$("#postCommentSimple").on("click", function () {
var commentInput = $("#commentInputSimple").val();
var xml = '<?xml version="1.0"?>' +
'<comment>' +
' <text>' + commentInput + '</text>' +
'</comment>';
$.ajax({
type: 'POST',
url: 'xxe/simple',
data: xml,
contentType: "application/xml",
dataType: 'xml',
complete: function (data) {
$("#commentInputSimple").val('');
getComments('#commentsListSimple')
}
})
});
getComments('#commentsListSimple');
});