diff --git a/webgoat-container/pom.xml b/webgoat-container/pom.xml
index 2884010c5..8ae30c4e6 100644
--- a/webgoat-container/pom.xml
+++ b/webgoat-container/pom.xml
@@ -211,6 +211,28 @@
+
+ com.github.webdriverextensions
+ webdriverextensions-maven-plugin
+ 3.0.2
+
+
+
+ install-drivers
+
+
+
+
+
+
+ chromedriver
+ windows
+ 64
+
+
+ true
+
+
@@ -470,6 +492,11 @@
${sauce_junit.version}
test
+
+ com.github.webdriverextensions
+ webdriverextensions
+ 2.8.0
+
diff --git a/webgoat-container/src/test/java/org/owasp/webgoat/plugins/WebGoatIT.java b/webgoat-container/src/test/java/org/owasp/webgoat/plugins/WebGoatIT.java
index ca8c1ee0e..f465b020f 100644
--- a/webgoat-container/src/test/java/org/owasp/webgoat/plugins/WebGoatIT.java
+++ b/webgoat-container/src/test/java/org/owasp/webgoat/plugins/WebGoatIT.java
@@ -29,6 +29,7 @@ import java.net.URL;
import java.util.LinkedList;
import java.util.concurrent.TimeUnit;
+import static com.github.webdriverextensions.WebDriverExtensionsContext.getDriver;
import static java.util.concurrent.TimeUnit.SECONDS;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNotNull;
@@ -327,6 +328,109 @@ public class WebGoatIT implements SauceOnDemandSessionIdProvider {
});
}
+ @Test
+ public void testRoleBasedAccessConrol() throws IOException {
+ doLoginWebgoatUser();
+
+ getWebDriver().get(baseWebGoatUrl + "/start.mvc#attack/160587164/200");
+ getWebDriver().get(baseWebGoatUrl + "/service/restartlesson.mvc");
+ getWebDriver().get(baseWebGoatUrl + "/start.mvc#attack/160587164/200");
+
+ FluentWait wait = new WebDriverWait(getDriver(), 15); // wait for a maximum of 15 seconds
+ wait.until(ExpectedConditions.textToBePresentInElementLocated(By.id("lesson-title"), "LAB: Role Based Access Control"));
+
+ wait = new FluentWait(getDriver())
+ .withTimeout(10, SECONDS)
+ .pollingEvery(2, SECONDS)
+ .ignoring(NoSuchElementException.class)
+ .ignoring(StaleElementReferenceException.class);
+ WebElement user = wait.until(ExpectedConditions.presenceOfElementLocated(By.name("employee_id")));
+ user.click();
+ user.sendKeys("T");
+
+ WebElement resource = getDriver().findElement(By.name("password"));
+ resource.click();
+ resource.sendKeys("tom");
+
+ WebElement submit = getDriver().findElement(By.name("action"));
+ submit.click();
+
+ wait = new FluentWait(getDriver())
+ .withTimeout(10, SECONDS)
+ .pollingEvery(2, SECONDS)
+ .ignoring(NoSuchElementException.class);
+
+ wait.until(new Predicate() {
+ public boolean apply(WebDriver webDriver) {
+ return webDriver.getPageSource().contains("Welcome Back");
+ }
+ });
+
+ JavascriptExecutor javascript = (JavascriptExecutor) getDriver();
+ String value = "document.getElementsByName('action')[0].value='DeleteProfile';";
+ javascript.executeScript(value);
+
+
+ WebElement viewProfile = getDriver().findElements(By.name("action")).get(0);
+ viewProfile.click();
+ wait = new FluentWait(getDriver())
+ .withTimeout(40, SECONDS)
+ .pollingEvery(2, SECONDS)
+ .ignoring(NoSuchElementException.class);
+
+ wait.until(new Predicate() {
+ public boolean apply(WebDriver webDriver) {
+ return webDriver.getPageSource().contains("Stage 2");
+ }
+ });
+
+ //
+ // Stage 3
+ //
+ getDriver().get(baseWebGoatUrl + "/start.mvc#attack/160587164/200/3");
+
+ user = wait.until(ExpectedConditions.presenceOfElementLocated(By.name("employee_id")));
+ user.click();
+ user.sendKeys("T");
+
+ resource = getDriver().findElement(By.name("password"));
+ resource.click();
+ resource.sendKeys("tom");
+
+ submit = getDriver().findElement(By.name("action"));
+ submit.click();
+
+ wait = new FluentWait(getDriver())
+ .withTimeout(10, SECONDS)
+ .pollingEvery(2, SECONDS)
+ .ignoring(NoSuchElementException.class);
+
+ wait.until(new Predicate() {
+ public boolean apply(WebDriver webDriver) {
+ return webDriver.getPageSource().contains("Welcome Back");
+ }
+ });
+
+ javascript = (JavascriptExecutor) getDriver();
+ value = "var select = document.getElementsByName('employee_id')[0]; select.options[0].value='106'; ";
+ javascript.executeScript(value);
+
+
+ viewProfile = getDriver().findElements(By.name("action")).get(0);
+ viewProfile.click();
+ wait = new FluentWait(getDriver())
+ .withTimeout(10, SECONDS)
+ .pollingEvery(2, SECONDS)
+ .ignoring(NoSuchElementException.class);
+
+ wait.until(new Predicate() {
+ public boolean apply(WebDriver webDriver) {
+ return webDriver.getPageSource().contains("You have completed Stage 3");
+ }
+ });
+
+ }
+
@Test
public void testFailOpenAuthenticationScheme() throws IOException {
doLoginWebgoatUser();