details = new HashMap<>();
+ public AttackResult completed(@RequestParam String url) {
try {
if (userSessionData.getValue("idor-authenticated-as").equals("tom")) {
//going to use session auth to view this one
- String authUserId = (String)userSessionData.getValue("idor-authenticated-user-id");
+ String authUserId = (String) userSessionData.getValue("idor-authenticated-user-id");
//don't care about http://localhost:8080 ... just want WebGoat/
String[] urlParts = url.split("/");
if (urlParts[0].equals("WebGoat") && urlParts[1].equals("IDOR") && urlParts[2].equals("profile") && urlParts[3].equals(authUserId)) {
@@ -74,9 +72,7 @@ public class IDORViewOwnProfileAltUrl extends AssignmentEndpoint{
return trackProgress(failed().feedback("idor.view.own.profile.failure2").build());
}
} catch (Exception ex) {
- System.out.println(ex.getMessage());
return failed().feedback("an error occurred with your request").build();
}
}
-
}
diff --git a/webgoat-lessons/insecure-deserialization/src/main/java/org/owasp/webgoat/plugin/InsecureDeserializationTask.java b/webgoat-lessons/insecure-deserialization/src/main/java/org/owasp/webgoat/plugin/InsecureDeserializationTask.java
index 39558864a..0abdc63e1 100755
--- a/webgoat-lessons/insecure-deserialization/src/main/java/org/owasp/webgoat/plugin/InsecureDeserializationTask.java
+++ b/webgoat-lessons/insecure-deserialization/src/main/java/org/owasp/webgoat/plugin/InsecureDeserializationTask.java
@@ -1,61 +1,58 @@
package org.owasp.webgoat.plugin;
import org.owasp.webgoat.assignments.AssignmentEndpoint;
-import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
-import javax.servlet.http.HttpServletRequest;
+import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
-import java.io.ByteArrayInputStream;
import java.util.Base64;
/**
* *************************************************************************************************
- *
- *
+ *
+ *
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
- *
+ *
* Copyright (c) 2002 - 20014 Bruce Mayhew
- *
+ *
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
- *
+ *
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
- *
+ *
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
- *
+ *
* Getting Source ==============
- *
+ *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* for free software projects.
- *
+ *
* For details, please see http://webgoat.github.io
*
* @author Bruce Mayhew WebGoat
* @created October 28, 2003
*/
-@AssignmentPath("/InsecureDeserialization/task")
+@RestController
public class InsecureDeserializationTask extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
- public
+ @PostMapping("/InsecureDeserialization/task")
@ResponseBody
- AttackResult completed(@RequestParam String token) throws IOException {
+ public AttackResult completed(@RequestParam String token) throws IOException {
String b64token;
- byte [] data;
+ byte[] data;
ObjectInputStream ois;
Object o;
long before, after;
@@ -64,7 +61,7 @@ public class InsecureDeserializationTask extends AssignmentEndpoint {
b64token = token.replace('-', '+').replace('_', '/');
try {
data = Base64.getDecoder().decode(b64token);
- ois = new ObjectInputStream( new ByteArrayInputStream(data) );
+ ois = new ObjectInputStream(new ByteArrayInputStream(data));
} catch (Exception e) {
return trackProgress(failed().build());
}
@@ -78,13 +75,13 @@ public class InsecureDeserializationTask extends AssignmentEndpoint {
after = System.currentTimeMillis();
ois.close();
- delay = (int)(after - before);
- if ( delay > 7000 ) {
+ delay = (int) (after - before);
+ if (delay > 7000) {
return trackProgress(failed().build());
}
- if ( delay < 3000 ) {
+ if (delay < 3000) {
return trackProgress(failed().build());
- }
+ }
return trackProgress(success().build());
}
-}
+}
\ No newline at end of file
diff --git a/webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/plugin/InsecureLoginTask.java b/webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/plugin/InsecureLoginTask.java
index e5895f39c..51e33faca 100755
--- a/webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/plugin/InsecureLoginTask.java
+++ b/webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/plugin/InsecureLoginTask.java
@@ -3,10 +3,7 @@ package org.owasp.webgoat.plugin;
import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
@@ -44,13 +41,12 @@ import java.io.IOException;
* @author Bruce Mayhew WebGoat
* @created October 28, 2003
*/
-@AssignmentPath("/InsecureLogin/task")
+@RestController
public class InsecureLoginTask extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
- public
+ @PostMapping("/InsecureLogin/task")
@ResponseBody
- AttackResult completed(@RequestParam String username, @RequestParam String password) throws IOException {
+ public AttackResult completed(@RequestParam String username, @RequestParam String password) {
if (username.toString().equals("CaptainJack") && password.toString().equals("BlackPearl")) {
return trackProgress(success().build());
}
diff --git a/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTFinalEndpoint.java b/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTFinalEndpoint.java
index 6efba6025..4e87b104c 100644
--- a/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTFinalEndpoint.java
+++ b/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTFinalEndpoint.java
@@ -11,10 +11,7 @@ import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities;
import org.owasp.webgoat.session.WebSession;
import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import java.sql.Connection;
import java.sql.ResultSet;
@@ -44,14 +41,14 @@ import java.sql.SQLException;
* @author nbaars
* @since 4/23/17.
*/
-@AssignmentPath("/JWT/final")
+@RestController
@AssignmentHints({"jwt-final-hint1", "jwt-final-hint2", "jwt-final-hint3", "jwt-final-hint4", "jwt-final-hint5", "jwt-final-hint6"})
public class JWTFinalEndpoint extends AssignmentEndpoint {
@Autowired
private WebSession webSession;
- @PostMapping("follow/{user}")
+ @PostMapping("/JWT/final/follow/{user}")
public @ResponseBody
String follow(@PathVariable("user") String user) {
if ("Jerry".equals(user)) {
@@ -61,7 +58,7 @@ public class JWTFinalEndpoint extends AssignmentEndpoint {
}
}
- @PostMapping("delete")
+ @PostMapping("/JWT/final/delete")
public @ResponseBody
AttackResult resetVotes(@RequestParam("token") String token) {
if (StringUtils.isEmpty(token)) {
diff --git a/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTRefreshEndpoint.java b/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTRefreshEndpoint.java
index 192a4bef7..85cc46321 100644
--- a/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTRefreshEndpoint.java
+++ b/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTRefreshEndpoint.java
@@ -13,10 +13,7 @@ import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestHeader;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import java.util.Date;
import java.util.List;
@@ -27,7 +24,7 @@ import java.util.concurrent.TimeUnit;
* @author nbaars
* @since 4/23/17.
*/
-@AssignmentPath("/JWT/refresh/")
+@RestController
@AssignmentHints({"jwt-refresh-hint1", "jwt-refresh-hint2", "jwt-refresh-hint3", "jwt-refresh-hint4"})
public class JWTRefreshEndpoint extends AssignmentEndpoint {
@@ -35,9 +32,9 @@ public class JWTRefreshEndpoint extends AssignmentEndpoint {
private static final String JWT_PASSWORD = "bm5n3SkxCX4kKRy4";
private static final List validRefreshTokens = Lists.newArrayList();
- @PostMapping(value = "login", consumes = MediaType.APPLICATION_JSON_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
- public @ResponseBody
- ResponseEntity follow(@RequestBody Map json) {
+ @PostMapping(value = "/JWT/refresh/login", consumes = MediaType.APPLICATION_JSON_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
+ @ResponseBody
+ public ResponseEntity follow(@RequestBody Map json) {
String user = (String) json.get("user");
String password = (String) json.get("password");
@@ -64,9 +61,9 @@ public class JWTRefreshEndpoint extends AssignmentEndpoint {
return tokenJson;
}
- @PostMapping("checkout")
- public @ResponseBody
- AttackResult checkout(@RequestHeader("Authorization") String token) {
+ @PostMapping("/JWT/refresh/checkout")
+ @ResponseBody
+ public AttackResult checkout(@RequestHeader("Authorization") String token) {
try {
Jwt jwt = Jwts.parser().setSigningKey(JWT_PASSWORD).parse(token.replace("Bearer ", ""));
Claims claims = (Claims) jwt.getBody();
@@ -82,9 +79,9 @@ public class JWTRefreshEndpoint extends AssignmentEndpoint {
}
}
- @PostMapping("newToken")
- public @ResponseBody
- ResponseEntity newToken(@RequestHeader("Authorization") String token, @RequestBody Map json) {
+ @PostMapping("/JWT/refresh/newToken")
+ @ResponseBody
+ public ResponseEntity newToken(@RequestHeader("Authorization") String token, @RequestBody Map json) {
String user;
String refreshToken;
try {
@@ -105,5 +102,4 @@ public class JWTRefreshEndpoint extends AssignmentEndpoint {
return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
}
}
-
}
diff --git a/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTSecretKeyEndpoint.java b/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTSecretKeyEndpoint.java
index f3f2ab8b7..4e2a0a71a 100644
--- a/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTSecretKeyEndpoint.java
+++ b/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTSecretKeyEndpoint.java
@@ -13,6 +13,7 @@ import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwt;
import io.jsonwebtoken.Jwts;
import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
import java.util.List;
@@ -20,7 +21,7 @@ import java.util.List;
* @author nbaars
* @since 4/23/17.
*/
-@AssignmentPath("/JWT/secret")
+@RestController
@AssignmentHints({"jwt-secret-hint1", "jwt-secret-hint2", "jwt-secret-hint3"})
public class JWTSecretKeyEndpoint extends AssignmentEndpoint {
@@ -28,7 +29,7 @@ public class JWTSecretKeyEndpoint extends AssignmentEndpoint {
private static final String WEBGOAT_USER = "WebGoat";
private static final List expectedClaims = Lists.newArrayList("iss", "iat", "exp", "aud", "sub", "username", "Email", "Role");
- @PostMapping
+ @PostMapping("/JWT/secret")
@ResponseBody
public AttackResult login(@RequestParam String token) {
try {
diff --git a/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTVotesEndpoint.java b/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTVotesEndpoint.java
index 49363b3b1..51939103f 100644
--- a/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTVotesEndpoint.java
+++ b/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTVotesEndpoint.java
@@ -35,7 +35,7 @@ import static java.util.stream.Collectors.toList;
* @author nbaars
* @since 4/23/17.
*/
-@AssignmentPath("/JWT/votings")
+@RestController
@AssignmentHints({"jwt-change-token-hint1", "jwt-change-token-hint2", "jwt-change-token-hint3", "jwt-change-token-hint4", "jwt-change-token-hint5"})
public class JWTVotesEndpoint extends AssignmentEndpoint {
@@ -64,7 +64,7 @@ public class JWTVotesEndpoint extends AssignmentEndpoint {
"challenge3-small.png", "challenge3.png", 10000, totalVotes));
}
- @GetMapping("/login")
+ @GetMapping("/JWT/votings/login")
public void login(@RequestParam("user") String user, HttpServletResponse response) {
if (validUsers.contains(user)) {
Claims claims = Jwts.claims().setIssuedAt(Date.from(Instant.now().plus(Duration.ofDays(10))));
@@ -86,7 +86,7 @@ public class JWTVotesEndpoint extends AssignmentEndpoint {
}
}
- @GetMapping
+ @GetMapping("/JWT/votings")
@ResponseBody
public MappingJacksonValue getVotes(@CookieValue(value = "access_token", required = false) String accessToken) {
MappingJacksonValue value = new MappingJacksonValue(votes.values().stream().sorted(comparingLong(Vote::getAverage).reversed()).collect(toList()));
@@ -109,7 +109,7 @@ public class JWTVotesEndpoint extends AssignmentEndpoint {
return value;
}
- @PostMapping(value = "{title}")
+ @PostMapping(value = "/JWT/votings/{title}")
@ResponseBody
@ResponseStatus(HttpStatus.ACCEPTED)
public ResponseEntity vote(@PathVariable String title, @CookieValue(value = "access_token", required = false) String accessToken) {
@@ -132,9 +132,9 @@ public class JWTVotesEndpoint extends AssignmentEndpoint {
}
}
- @PostMapping("reset")
- public @ResponseBody
- AttackResult resetVotes(@CookieValue(value = "access_token", required = false) String accessToken) {
+ @PostMapping("/JWT/votings/reset")
+ @ResponseBody
+ public AttackResult resetVotes(@CookieValue(value = "access_token", required = false) String accessToken) {
if (StringUtils.isEmpty(accessToken)) {
return trackProgress(failed().feedback("jwt-invalid-token").build());
} else {
diff --git a/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACHiddenMenus.java b/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACHiddenMenus.java
index 1db9efa36..33077452a 100644
--- a/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACHiddenMenus.java
+++ b/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACHiddenMenus.java
@@ -7,10 +7,7 @@ import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.UserSessionData;
import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
@@ -24,8 +21,7 @@ import java.util.Map;
/**
* Created by jason on 1/5/17.
*/
-
-@AssignmentPath("/access-control/hidden-menu")
+@RestController
@AssignmentHints({"access-control.hidden-menus.hint1","access-control.hidden-menus.hint2","access-control.hidden-menus.hint3"})
public class MissingFunctionACHiddenMenus extends AssignmentEndpoint {
//UserSessionData is bound to session and can be used to persist data across multiple assignments
@@ -33,10 +29,9 @@ public class MissingFunctionACHiddenMenus extends AssignmentEndpoint {
UserSessionData userSessionData;
- @PostMapping(produces = {"application/json"})
- public @ResponseBody
- AttackResult completed(String hiddenMenu1, String hiddenMenu2, HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-
+ @PostMapping(path = "/access-control/hidden-menu", produces = {"application/json"})
+ @ResponseBody
+ public AttackResult completed(String hiddenMenu1, String hiddenMenu2) {
//overly simple example for success. See other existing lesssons for ways to detect 'success' or 'failure'
if (hiddenMenu1.equals("Users") && hiddenMenu2.equals("Config")) {
return trackProgress(success()
@@ -57,5 +52,4 @@ public class MissingFunctionACHiddenMenus extends AssignmentEndpoint {
.output("")
.build());
}
-
}
diff --git a/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACUsers.java b/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACUsers.java
index e45699696..e1d742ced 100644
--- a/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACUsers.java
+++ b/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACUsers.java
@@ -21,7 +21,6 @@ import java.util.List;
@Controller
public class MissingFunctionACUsers {
-
// this will actually put controllers on the /WebGoat/* path ... the jsp for list_users restricts what can be seen, but the add_user is not controlled carefully
@Autowired
private UserService userService;
diff --git a/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACYourHash.java b/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACYourHash.java
index d830ac7a1..389b50100 100644
--- a/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACYourHash.java
+++ b/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACYourHash.java
@@ -9,8 +9,9 @@ import org.owasp.webgoat.users.WebGoatUser;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
-@AssignmentPath("/access-control/user-hash")
+@RestController
@AssignmentHints({"access-control.hash.hint1","access-control.hash.hint2","access-control.hash.hint3",
"access-control.hash.hint4","access-control.hash.hint5","access-control.hash.hint6","access-control.hash.hint7",
"access-control.hash.hint8","access-control.hash.hint9","access-control.hash.hint10","access-control.hash.hint11","access-control.hash.hint12"})
@@ -19,9 +20,9 @@ public class MissingFunctionACYourHash extends AssignmentEndpoint {
@Autowired
private UserService userService;
- @PostMapping(produces = {"application/json"})
- public @ResponseBody
- AttackResult completed(String userHash) {
+ @PostMapping(path = "/access-control/user-hash", produces = {"application/json"})
+ @ResponseBody
+ public AttackResult completed(String userHash) {
String currentUser = getWebSession().getUserName();
WebGoatUser user = userService.loadUserByUsername(currentUser);
DisplayUser displayUser = new DisplayUser(user);
diff --git a/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/Users.java b/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/Users.java
index e7441b6ec..e362552f4 100644
--- a/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/Users.java
+++ b/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/Users.java
@@ -4,6 +4,7 @@ import org.owasp.webgoat.session.DatabaseUtilities;
import org.owasp.webgoat.session.UserSessionData;
import org.owasp.webgoat.session.WebSession;
import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.ResponseBody;
@@ -20,9 +21,9 @@ public class Users {
@Autowired
UserSessionData userSessionData;
- @RequestMapping(produces = {"application/json"}, method = RequestMethod.GET)
+ @GetMapping(produces = {"application/json"})
@ResponseBody
- protected HashMap getUsers (HttpServletRequest req) {
+ protected HashMap getUsers() {
try {
Connection connection = DatabaseUtilities.getConnection(getWebSession());
diff --git a/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/QuestionsAssignment.java b/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/QuestionsAssignment.java
index dd5aa247a..c0ef0f94c 100644
--- a/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/QuestionsAssignment.java
+++ b/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/QuestionsAssignment.java
@@ -1,20 +1,13 @@
package org.owasp.webgoat.plugin;
-import org.apache.commons.lang3.StringUtils;
import org.owasp.webgoat.assignments.AssignmentEndpoint;
-import org.owasp.webgoat.assignments.AssignmentHints;
-import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
-import org.owasp.webgoat.plugin.PasswordResetEmail;
-import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.MediaType;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
-import org.springframework.web.client.RestClientException;
-import org.springframework.web.client.RestTemplate;
+import org.springframework.web.bind.annotation.RestController;
-import java.time.LocalDateTime;
import java.util.HashMap;
import java.util.Map;
@@ -22,7 +15,7 @@ import java.util.Map;
* @author nbaars
* @since 8/20/17.
*/
-@AssignmentPath("/PasswordReset/questions")
+@RestController
public class QuestionsAssignment extends AssignmentEndpoint {
private final static Map COLORS = new HashMap<>();
@@ -35,7 +28,7 @@ public class QuestionsAssignment extends AssignmentEndpoint {
COLORS.put("webgoat", "red");
}
- @PostMapping(consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
+ @PostMapping(path = "/PasswordReset/questions", consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
@ResponseBody
public AttackResult passwordReset(@RequestParam Map json) {
String securityQuestion = (String) json.getOrDefault("securityQuestion", "");
diff --git a/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/ResetLinkAssignment.java b/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/ResetLinkAssignment.java
index 84e7ab5a0..39cbf9aca 100644
--- a/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/ResetLinkAssignment.java
+++ b/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/ResetLinkAssignment.java
@@ -17,7 +17,7 @@ import java.util.Map;
* @author nbaars
* @since 8/20/17.
*/
-@AssignmentPath("/PasswordReset/reset")
+@RestController
@AssignmentHints({"password-reset-hint1", "password-reset-hint2", "password-reset-hint3", "password-reset-hint4", "password-reset-hint5", "password-reset-hint6"})
public class ResetLinkAssignment extends AssignmentEndpoint {
@@ -37,7 +37,7 @@ public class ResetLinkAssignment extends AssignmentEndpoint {
"Kind regards, \nTeam WebGoat";
- @PostMapping("/login")
+ @PostMapping("/PasswordReset/reset/login")
@ResponseBody
public AttackResult login(@RequestParam String password, @RequestParam String email) {
if (TOM_EMAIL.equals(email)) {
@@ -51,7 +51,7 @@ public class ResetLinkAssignment extends AssignmentEndpoint {
return trackProgress(failed().feedback("login_failed.tom").build());
}
- @GetMapping("/reset-password/{link}")
+ @GetMapping("/PasswordReset/reset/reset-password/{link}")
public String resetPassword(@PathVariable(value = "link") String link, Model model) {
if (this.resetLinks.contains(link)) {
PasswordChangeForm form = new PasswordChangeForm();
@@ -63,7 +63,7 @@ public class ResetLinkAssignment extends AssignmentEndpoint {
}
}
- @PostMapping("/change-password")
+ @PostMapping("/PasswordReset/reset/change-password")
public String changePassword(@ModelAttribute("form") PasswordChangeForm form, BindingResult bindingResult) {
if (!org.springframework.util.StringUtils.hasText(form.getPassword())) {
bindingResult.rejectValue("password", "not.empty");
diff --git a/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/ResetLinkAssignmentForgotPassword.java b/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/ResetLinkAssignmentForgotPassword.java
index 88bb7cd24..8cba8fc5c 100644
--- a/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/ResetLinkAssignmentForgotPassword.java
+++ b/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/ResetLinkAssignmentForgotPassword.java
@@ -7,9 +7,7 @@ import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpEntity;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import org.springframework.web.client.RestTemplate;
import javax.servlet.http.HttpServletRequest;
@@ -25,7 +23,7 @@ import static org.springframework.web.bind.annotation.RequestMethod.POST;
* @author nbaars
* @since 8/20/17.
*/
-@AssignmentPath("/PasswordReset/ForgotPassword")
+@RestController
public class ResetLinkAssignmentForgotPassword extends AssignmentEndpoint {
private final RestTemplate restTemplate;
@@ -37,7 +35,7 @@ public class ResetLinkAssignmentForgotPassword extends AssignmentEndpoint {
this.webWolfMailURL = webWolfMailURL;
}
- @RequestMapping(method = POST, value = "/create-password-reset-link")
+ @PostMapping("/PasswordReset/ForgotPassword/create-password-reset-link")
@ResponseBody
public AttackResult sendPasswordResetLink(@RequestParam String email, HttpServletRequest request) {
String resetLink = UUID.randomUUID().toString();
@@ -58,7 +56,7 @@ public class ResetLinkAssignmentForgotPassword extends AssignmentEndpoint {
return success().feedback("email.send").feedbackArgs(email).build();
}
- private void sendMailToUser(@RequestParam String email, String host, String resetLink) {
+ private void sendMailToUser(String email, String host, String resetLink) {
int index = email.indexOf("@");
String username = email.substring(0, index == -1 ? email.length() : index);
PasswordResetEmail mail = PasswordResetEmail.builder()
@@ -78,5 +76,4 @@ public class ResetLinkAssignmentForgotPassword extends AssignmentEndpoint {
//don't care
}
}
-
}
diff --git a/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/SecurityQuestionAssignment.java b/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/SecurityQuestionAssignment.java
index 0210f8dee..ff3f95fc9 100644
--- a/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/SecurityQuestionAssignment.java
+++ b/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/SecurityQuestionAssignment.java
@@ -4,10 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import java.util.HashMap;
import java.util.Map;
@@ -20,7 +17,7 @@ import static java.util.Optional.of;
* @author Tobias Melzer
* @since 11.12.18
*/
-@AssignmentPath("/PasswordReset/SecurityQuestions")
+@RestController
public class SecurityQuestionAssignment extends AssignmentEndpoint {
@Autowired
@@ -46,7 +43,7 @@ public class SecurityQuestionAssignment extends AssignmentEndpoint {
questions.put("What is your favorite color?", "Can easily be guessed.");
}
- @RequestMapping(method = RequestMethod.POST)
+ @PostMapping("/PasswordReset/SecurityQuestions")
@ResponseBody
public AttackResult completed(@RequestParam String question) {
var answer = of(questions.get(question));
diff --git a/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/SimpleMailAssignment.java b/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/SimpleMailAssignment.java
index e32815d66..1813050d6 100644
--- a/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/SimpleMailAssignment.java
+++ b/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/SimpleMailAssignment.java
@@ -9,6 +9,7 @@ import org.springframework.http.MediaType;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.client.RestClientException;
import org.springframework.web.client.RestTemplate;
@@ -20,8 +21,7 @@ import static java.util.Optional.ofNullable;
* @author nbaars
* @since 8/20/17.
*/
-@AssignmentPath("/PasswordReset/simple-mail")
-
+@RestController
public class SimpleMailAssignment extends AssignmentEndpoint {
private final String webWolfURL;
@@ -32,7 +32,7 @@ public class SimpleMailAssignment extends AssignmentEndpoint {
this.webWolfURL = webWolfURL;
}
- @PostMapping(consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
+ @PostMapping(path = "/PasswordReset/simple-mail", consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
@ResponseBody
public AttackResult login(@RequestParam String email, @RequestParam String password) {
String emailAddress = ofNullable(email).orElse("unknown@webgoat.org");
@@ -45,7 +45,7 @@ public class SimpleMailAssignment extends AssignmentEndpoint {
}
}
- @PostMapping(consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE, value = "/reset")
+ @PostMapping(consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE, value = "/PasswordReset/simple-mail/reset")
@ResponseBody
public AttackResult resetPassword(@RequestParam String emailReset) {
String email = ofNullable(emailReset).orElse("unknown@webgoat.org");
diff --git a/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/plugin/SecurePasswordsAssignment.java b/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/plugin/SecurePasswordsAssignment.java
index f3dea6c63..91f9ca093 100644
--- a/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/plugin/SecurePasswordsAssignment.java
+++ b/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/plugin/SecurePasswordsAssignment.java
@@ -1,35 +1,19 @@
package org.owasp.webgoat.plugin;
-import com.nulabinc.zxcvbn.Feedback;
import com.nulabinc.zxcvbn.Strength;
import com.nulabinc.zxcvbn.Zxcvbn;
-import org.jruby.RubyProcess;
import org.owasp.webgoat.assignments.AssignmentEndpoint;
-import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
-
-import javax.tools.*;
-import java.io.IOException;
-import java.net.URI;
import java.text.DecimalFormat;
import java.text.DecimalFormatSymbols;
-import java.util.Arrays;
-import java.util.List;
import java.util.Locale;
-import java.util.ResourceBundle;
-import java.util.concurrent.TimeUnit;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-@AssignmentPath("SecurePasswords/assignment")
+@RestController
public class SecurePasswordsAssignment extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
+ @PostMapping("SecurePasswords/assignment")
@ResponseBody
public AttackResult completed(@RequestParam String password) {
Zxcvbn zxcvbn = new Zxcvbn();
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallenge.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallenge.java
index 88368f96c..4f7d48c5f 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallenge.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallenge.java
@@ -13,6 +13,7 @@ import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.PutMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
import java.sql.*;
@@ -20,7 +21,7 @@ import java.sql.*;
* @author nbaars
* @since 4/8/17.
*/
-@AssignmentPath("/SqlInjectionAdvanced/challenge")
+@RestController
@AssignmentHints(value = {"SqlInjectionChallenge1", "SqlInjectionChallenge2", "SqlInjectionChallenge3"})
@Slf4j
public class SqlInjectionChallenge extends AssignmentEndpoint {
@@ -36,7 +37,7 @@ public class SqlInjectionChallenge extends AssignmentEndpoint {
log.info("Challenge 6 tablename is: {}", USERS_TABLE_NAME);
}
- @PutMapping //assignment path is bounded to class so we use different http method :-)
+ @PutMapping("/SqlInjectionAdvanced/challenge") //assignment path is bounded to class so we use different http method :-)
@ResponseBody
public AttackResult registerNewUser(@RequestParam String username_reg, @RequestParam String email_reg, @RequestParam String password_reg) throws Exception {
AttackResult attackResult = checkArguments(username_reg, email_reg, password_reg);
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallengeLogin.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallengeLogin.java
index 29095667b..1b4d14a40 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallengeLogin.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallengeLogin.java
@@ -7,23 +7,20 @@ import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities;
import org.owasp.webgoat.session.WebSession;
import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import java.sql.*;
import static org.springframework.web.bind.annotation.RequestMethod.POST;
-@AssignmentPath("/SqlInjectionAdvanced/challenge_Login")
+@RestController
@AssignmentHints(value ={"SqlInjectionChallengeHint1", "SqlInjectionChallengeHint2", "SqlInjectionChallengeHint3", "SqlInjectionChallengeHint4"})
public class SqlInjectionChallengeLogin extends AssignmentEndpoint {
@Autowired
private WebSession webSession;
-
- @RequestMapping(method = POST)
+ @PostMapping("/SqlInjectionAdvanced/challenge_Login")
@ResponseBody
public AttackResult login(@RequestParam String username_login, @RequestParam String password_login) throws Exception {
Connection connection = DatabaseUtilities.getConnection(webSession);
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6a.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6a.java
index f2affbeee..42f8b7cb3 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6a.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6a.java
@@ -42,15 +42,14 @@ import java.sql.*;
* @author Bruce Mayhew WebGoat
* @created October 28, 2003
*/
-@AssignmentPath("/SqlInjectionAdvanced/attack6a")
+@RestController
@AssignmentHints(value = {"SqlStringInjectionHint-advanced-6a-1", "SqlStringInjectionHint-advanced-6a-2", "SqlStringInjectionHint-advanced-6a-3",
"SqlStringInjectionHint-advanced-6a-4"})
public class SqlInjectionLesson6a extends AssignmentEndpoint {
- @PostMapping
- public
+ @PostMapping("/SqlInjectionAdvanced/attack6a")
@ResponseBody
- AttackResult completed(@RequestParam String userid_6a) throws IOException {
+ public AttackResult completed(@RequestParam String userid_6a) throws IOException {
return injectableQuery(userid_6a);
// The answer: Smith' union select userid,user_name, password,cookie,cookie, cookie,userid from user_system_data --
}
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6b.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6b.java
index a6e276bd2..bd8159abd 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6b.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6b.java
@@ -5,10 +5,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import java.io.IOException;
import java.sql.Connection;
@@ -47,10 +44,10 @@ import java.sql.Statement;
* @author Bruce Mayhew WebGoat
* @created October 28, 2003
*/
-@AssignmentPath("/SqlInjectionAdvanced/attack6b")
+@RestController
public class SqlInjectionLesson6b extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
+ @PostMapping("/SqlInjectionAdvanced/attack6b")
@ResponseBody
public AttackResult completed(@RequestParam String userid_6b) throws IOException {
if (userid_6b.toString().equals(getPassword())) {
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionQuiz.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionQuiz.java
index 6367c48f7..974745f9f 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionQuiz.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionQuiz.java
@@ -4,10 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import java.io.IOException;
import java.sql.Connection;
@@ -21,13 +18,13 @@ import java.sql.Statement;
* 3. add Request param with name of question to method head
* For a more detailed description how to implement the quiz go to the quiz.js file in webgoat-container -> js
*/
-@AssignmentPath("/SqlInjectionAdvanced/quiz")
+@RestController
public class SqlInjectionQuiz extends AssignmentEndpoint {
String[] solutions = {"Solution 4", "Solution 3", "Solution 2", "Solution 3", "Solution 4"};
boolean[] guesses = new boolean[solutions.length];
- @RequestMapping(method = RequestMethod.POST)
+ @PostMapping("/SqlInjectionAdvanced/quiz")
@ResponseBody
public AttackResult completed(@RequestParam String[] question_0_solution, @RequestParam String[] question_1_solution, @RequestParam String[] question_2_solution, @RequestParam String[] question_3_solution, @RequestParam String[] question_4_solution) throws IOException {
int correctAnswers = 0;
@@ -52,7 +49,7 @@ public class SqlInjectionQuiz extends AssignmentEndpoint {
}
}
- @RequestMapping(method = RequestMethod.GET)
+ @GetMapping("/SqlInjectionAdvanced/quiz")
@ResponseBody
public boolean[] getResults() {
return this.guesses;
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson10.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson10.java
index 1f30c7a05..a3561a8fb 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson10.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson10.java
@@ -6,21 +6,17 @@ import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import java.sql.*;
-@AssignmentPath("/SqlInjection/attack10")
+@RestController
@AssignmentHints(value = {"SqlStringInjectionHint.10.1", "SqlStringInjectionHint.10.2", "SqlStringInjectionHint.10.3", "SqlStringInjectionHint.10.4", "SqlStringInjectionHint.10.5", "SqlStringInjectionHint.10.6"})
public class SqlInjectionLesson10 extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
- public
+ @PostMapping("/SqlInjection/attack10")
@ResponseBody
- AttackResult completed(@RequestParam String action_string) {
+ public AttackResult completed(@RequestParam String action_string) {
return injectableQueryAvailability(action_string);
}
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson2.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson2.java
index 810d7b7ad..dfbd33f85 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson2.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson2.java
@@ -6,10 +6,7 @@ import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import java.io.IOException;
import java.sql.*;
@@ -45,14 +42,13 @@ import java.sql.*;
* @author Bruce Mayhew WebGoat
* @created October 28, 2003
*/
-@AssignmentPath("/SqlInjection/attack2")
+@RestController
@AssignmentHints(value = {"SqlStringInjectionHint2-1", "SqlStringInjectionHint2-2", "SqlStringInjectionHint2-3", "SqlStringInjectionHint2-4"})
public class SqlInjectionLesson2 extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
- public
+ @PostMapping("/SqlInjection/attack2")
@ResponseBody
- AttackResult completed(@RequestParam String query) {
+ public AttackResult completed(@RequestParam String query) {
return injectableQuery(query);
}
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson3.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson3.java
index 4df77b99a..675028d6b 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson3.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson3.java
@@ -6,10 +6,7 @@ import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import java.io.IOException;
import java.sql.*;
@@ -45,14 +42,13 @@ import java.sql.*;
* @author Bruce Mayhew WebGoat
* @created October 28, 2003
*/
-@AssignmentPath("/SqlInjection/attack3")
+@RestController
@AssignmentHints(value = {"SqlStringInjectionHint3-1", "SqlStringInjectionHint3-2"})
public class SqlInjectionLesson3 extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
- public
+ @PostMapping("/SqlInjection/attack3")
@ResponseBody
- AttackResult completed(@RequestParam String query) {
+ public AttackResult completed(@RequestParam String query) {
return injectableQuery(query);
}
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson4.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson4.java
index 6488b8104..be0729698 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson4.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson4.java
@@ -6,10 +6,7 @@ import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import java.io.IOException;
import java.sql.*;
@@ -45,22 +42,19 @@ import java.sql.*;
* @author Bruce Mayhew WebGoat
* @created October 28, 2003
*/
-@AssignmentPath("/SqlInjection/attack4")
+@RestController
@AssignmentHints(value = {"SqlStringInjectionHint4-1", "SqlStringInjectionHint4-2", "SqlStringInjectionHint4-3"})
public class SqlInjectionLesson4 extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
- public
+ @PostMapping("/SqlInjection/attack4")
@ResponseBody
- AttackResult completed(@RequestParam String query) {
+ public AttackResult completed(@RequestParam String query) {
return injectableQuery(query);
}
protected AttackResult injectableQuery(String _query) {
try {
Connection connection = DatabaseUtilities.getConnection(getWebSession());
- String query = _query;
-
try {
Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
ResultSet.CONCUR_READ_ONLY);
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5.java
index 66ff057f9..7cb86195d 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5.java
@@ -3,16 +3,11 @@ package org.owasp.webgoat.plugin.introduction;
import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints;
-import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
-import org.owasp.webgoat.session.DatabaseUtilities;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
-
-import java.io.IOException;
-import java.sql.*;
+import org.springframework.web.bind.annotation.RestController;
/***************************************************************************************************
@@ -45,20 +40,18 @@ import java.sql.*;
* @author Bruce Mayhew WebGoat
* @created October 28, 2003
*/
-@AssignmentPath("/SqlInjection/attack5")
+@RestController
@AssignmentHints(value = {"SqlStringInjectionHint5-a"})
public class SqlInjectionLesson5 extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
- public
+ @PostMapping("/SqlInjection/attack5")
@ResponseBody
- AttackResult completed(@RequestParam String query) {
+ public AttackResult completed(@RequestParam String query) {
return injectableQuery(query);
}
protected AttackResult injectableQuery(String _query) {
try {
- String query = _query;
String regex = "(?i)^(grant alter table to unauthorizedUser)(?:[;]?)$";
Boolean isCorrect = false;
StringBuffer output = new StringBuffer();
@@ -70,7 +63,6 @@ public class SqlInjectionLesson5 extends AssignmentEndpoint {
} else {
return trackProgress(failed().output(output.toString()).build());
}
-
} catch (Exception e) {
return trackProgress(failed().output(this.getClass().getName() + " : " + e.getMessage()).build());
}
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5a.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5a.java
index 58ea415d9..0a203d39c 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5a.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5a.java
@@ -41,7 +41,7 @@ import java.sql.*;
* @author Bruce Mayhew WebGoat
* @created October 28, 2003
*/
-@AssignmentPath("/SqlInjection/assignment5a")
+@RestController
@AssignmentHints(value = {"SqlStringInjectionHint5a1"})
public class SqlInjectionLesson5a extends AssignmentEndpoint {
@@ -50,10 +50,9 @@ public class SqlInjectionLesson5a extends AssignmentEndpoint {
+ "So the injected query basically looks like this: SELECT * FROM user_data WHERE first_name = 'John' and last_name = '' or TRUE, "
+ "which will always evaluate to true, no matter what came before it.";
- @PostMapping
- public
+ @PostMapping("/SqlInjection/assignment5a")
@ResponseBody
- AttackResult completed(@RequestParam String account, @RequestParam String operator, @RequestParam String injection) {
+ public AttackResult completed(@RequestParam String account, @RequestParam String operator, @RequestParam String injection) {
return injectableQuery(account + " " + operator + " " + injection);
}
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5b.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5b.java
index 320554a10..690afcaab 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5b.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5b.java
@@ -6,10 +6,7 @@ import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
@@ -46,18 +43,16 @@ import java.sql.*;
* @author Bruce Mayhew WebGoat
* @created October 28, 2003
*/
-@AssignmentPath("/SqlInjection/assignment5b")
+@RestController
@AssignmentHints(value = {"SqlStringInjectionHint5b1", "SqlStringInjectionHint5b2", "SqlStringInjectionHint5b3", "SqlStringInjectionHint5b4"})
public class SqlInjectionLesson5b extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
- public
+ @PostMapping("/SqlInjection/assignment5b")
@ResponseBody
- AttackResult completed(@RequestParam String userid, @RequestParam String login_count, HttpServletRequest request) throws IOException {
+ public AttackResult completed(@RequestParam String userid, @RequestParam String login_count, HttpServletRequest request) throws IOException {
return injectableQuery(login_count, userid);
}
-
protected AttackResult injectableQuery(String login_count, String accountName) {
String queryString = "SELECT * From user_data WHERE Login_Count = ? and userid= " + accountName;
try {
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson8.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson8.java
index 45a86560a..b0d5ea2e9 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson8.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson8.java
@@ -6,23 +6,20 @@ import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
+
import java.util.Calendar;
import java.text.SimpleDateFormat;
import java.sql.*;
-@AssignmentPath("/SqlInjection/attack8")
+@RestController
@AssignmentHints(value = {"SqlStringInjectionHint.8.1", "SqlStringInjectionHint.8.2", "SqlStringInjectionHint.8.3", "SqlStringInjectionHint.8.4", "SqlStringInjectionHint.8.5"})
public class SqlInjectionLesson8 extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
- public
+ @PostMapping("/SqlInjection/attack8")
@ResponseBody
- AttackResult completed(@RequestParam String name, @RequestParam String auth_tan) {
+ public AttackResult completed(@RequestParam String name, @RequestParam String auth_tan) {
return injectableQueryConfidentiality(name, auth_tan);
}
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson9.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson9.java
index 55e4008c6..122b81284 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson9.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson9.java
@@ -3,24 +3,25 @@ package org.owasp.webgoat.plugin.introduction;
import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints;
-import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
-import java.sql.*;
+import java.sql.Connection;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
-@AssignmentPath("/SqlInjection/attack9")
+@RestController
@AssignmentHints(value = {"SqlStringInjectionHint.9.1", "SqlStringInjectionHint.9.2", "SqlStringInjectionHint.9.3", "SqlStringInjectionHint.9.4", "SqlStringInjectionHint.9.5"})
public class SqlInjectionLesson9 extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
- public
+ @PostMapping("/SqlInjection/attack9")
@ResponseBody
- AttackResult completed(@RequestParam String name, @RequestParam String auth_tan) {
+ public AttackResult completed(@RequestParam String name, @RequestParam String auth_tan) {
return injectableQueryIntegrity(name, auth_tan);
}
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10a.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10a.java
index 1c531e2df..86fc70673 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10a.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10a.java
@@ -8,25 +8,19 @@ import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.WebSession;
import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
-@AssignmentPath("SqlInjectionMitigations/attack10a")
+@RestController
@Slf4j
@AssignmentHints(value = {"SqlStringInjectionHint-mitigation-10a-1", "SqlStringInjectionHint-mitigation-10a-10a2"})
public class SqlInjectionLesson10a extends AssignmentEndpoint {
@Autowired
private WebSession webSession;
- // @TODO: Maybe provide regex instead of "hard coded" strings
private String[] results = {"getConnection", "PreparedStatement", "prepareStatement", "?", "?", "setString", "setString"};
- // @TODO Method head too big, better solution?
- @RequestMapping(method = RequestMethod.POST)
+ @PostMapping("SqlInjectionMitigations/attack10a")
@ResponseBody
- @SneakyThrows
public AttackResult completed(@RequestParam String field1, @RequestParam String field2, @RequestParam String field3, @RequestParam String field4, @RequestParam String field5, @RequestParam String field6, @RequestParam String field7) {
String[] userInput = {field1, field2, field3, field4, field5, field6, field7};
int position = 0;
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java
index b47c7580c..3f921e8d9 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java
@@ -4,10 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import javax.servlet.http.HttpServletRequest;
import javax.tools.*;
@@ -18,11 +15,11 @@ import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
-@AssignmentPath("SqlInjectionMitigations/attack10b")
+@RestController
@AssignmentHints(value = {"SqlStringInjectionHint-mitigation-10b-1", "SqlStringInjectionHint-mitigation-10b-2", "SqlStringInjectionHint-mitigation-10b-3", "SqlStringInjectionHint-mitigation-10b-4", "SqlStringInjectionHint-mitigation-10b-5"})
public class SqlInjectionLesson10b extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
+ @PostMapping("SqlInjectionMitigations/attack10b")
@ResponseBody
public AttackResult completed(@RequestParam String editor) {
try {
diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java
index d99be9505..5d0c2f18b 100644
--- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java
+++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java
@@ -4,23 +4,24 @@ import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints;
-import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities;
import org.owasp.webgoat.session.WebSession;
import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
-import java.sql.*;
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
/**
* @author nbaars
* @since 6/13/17.
*/
-@AssignmentPath("SqlInjectionMitigations/attack12a")
+@RestController
@AssignmentHints(value = {"SqlStringInjectionHint-mitigation-12a-1", "SqlStringInjectionHint-mitigation-12a-2", "SqlStringInjectionHint-mitigation-12a-3", "SqlStringInjectionHint-mitigation-12a-4"})
@Slf4j
public class SqlInjectionLesson12a extends AssignmentEndpoint {
@@ -28,7 +29,7 @@ public class SqlInjectionLesson12a extends AssignmentEndpoint {
@Autowired
private WebSession webSession;
- @RequestMapping(method = RequestMethod.POST)
+ @PostMapping("SqlInjectionMitigations/attack12a")
@ResponseBody
@SneakyThrows
public AttackResult completed(@RequestParam String ip) {
@@ -42,6 +43,4 @@ public class SqlInjectionLesson12a extends AssignmentEndpoint {
}
return trackProgress(failed().build());
}
-}
-
-
+}
\ No newline at end of file
diff --git a/webgoat-lessons/ssrf/src/main/java/org/owasp/webgoat/plugin/SSRFTask1.java b/webgoat-lessons/ssrf/src/main/java/org/owasp/webgoat/plugin/SSRFTask1.java
index 2e351b5eb..55196383c 100755
--- a/webgoat-lessons/ssrf/src/main/java/org/owasp/webgoat/plugin/SSRFTask1.java
+++ b/webgoat-lessons/ssrf/src/main/java/org/owasp/webgoat/plugin/SSRFTask1.java
@@ -4,10 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
@@ -22,77 +19,75 @@ import java.net.URLConnection;
/**
* *************************************************************************************************
- *
- *
+ *
+ *
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
- *
+ *
* Copyright (c) 2002 - 2014 Bruce Mayhew
- *
+ *
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
- *
+ *
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
- *
+ *
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
- *
+ *
* Getting Source ==============
- *
+ *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* for free software projects.
- *
+ *
* For details, please see http://webgoat.github.io
*
* @author Alex Fry WebGoat
* @created December 26, 2018
*/
-@AssignmentPath("/SSRF/task1")
-@AssignmentHints({"ssrf.hint1","ssrf.hint2"})
+@RestController
+@AssignmentHints({"ssrf.hint1", "ssrf.hint2"})
public class SSRFTask1 extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
- public @ResponseBody
-
- AttackResult completed(@RequestParam String url) throws IOException {
+ @PostMapping("/SSRF/task1")
+ @ResponseBody
+ public AttackResult completed(@RequestParam String url) {
return stealTheCheese(url);
}
protected AttackResult stealTheCheese(String url) {
try {
- StringBuffer html = new StringBuffer();
+ StringBuffer html = new StringBuffer();
- if (url.matches("images/tom.png")) {
- html.append("![\"Tom\"](\"images/tom.png\")
");
- return trackProgress(failed()
- .feedback("ssrf.tom")
- .output(html.toString())
- .build());
- }else if (url.matches("images/jerry.png")){
- html.append("![\"Jerry\"](\"images/jerry.png\")
");
- return trackProgress(success()
- .feedback("ssrf.success")
- .output(html.toString())
- .build());
- }else{
- html.append("![\"Silly](\"images/cat.jpg\")
");
- return trackProgress(failed()
- .feedback("ssrf.failure")
- .output(html.toString())
- .build());
- }
-
- }catch(Exception e) {
- e.printStackTrace();
+ if (url.matches("images/tom.png")) {
+ html.append("");
return trackProgress(failed()
- .output(e.getMessage())
- .build());
+ .feedback("ssrf.tom")
+ .output(html.toString())
+ .build());
+ } else if (url.matches("images/jerry.png")) {
+ html.append("");
+ return trackProgress(success()
+ .feedback("ssrf.success")
+ .output(html.toString())
+ .build());
+ } else {
+ html.append("");
+ return trackProgress(failed()
+ .feedback("ssrf.failure")
+ .output(html.toString())
+ .build());
}
+ } catch (Exception e) {
+ e.printStackTrace();
+ return trackProgress(failed()
+ .output(e.getMessage())
+ .build());
+ }
}
}
diff --git a/webgoat-lessons/ssrf/src/main/java/org/owasp/webgoat/plugin/SSRFTask2.java b/webgoat-lessons/ssrf/src/main/java/org/owasp/webgoat/plugin/SSRFTask2.java
index fa0c8f03f..af03ce3ed 100755
--- a/webgoat-lessons/ssrf/src/main/java/org/owasp/webgoat/plugin/SSRFTask2.java
+++ b/webgoat-lessons/ssrf/src/main/java/org/owasp/webgoat/plugin/SSRFTask2.java
@@ -4,10 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
@@ -22,80 +19,78 @@ import java.net.URLConnection;
/**
* *************************************************************************************************
- *
- *
+ *
+ *
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
- *
+ *
* Copyright (c) 2002 - 2014 Bruce Mayhew
- *
+ *
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
- *
+ *
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
- *
+ *
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
- *
+ *
* Getting Source ==============
- *
+ *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* for free software projects.
- *
+ *
* For details, please see http://webgoat.github.io
*
* @author Alex Fry WebGoat
* @created December 26, 2018
*/
-@AssignmentPath("/SSRF/task2")
+@RestController
@AssignmentHints({"ssrf.hint3"})
public class SSRFTask2 extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
- public @ResponseBody
-
- AttackResult completed(@RequestParam String url) throws IOException {
+ @PostMapping("/SSRF/task2")
+ @ResponseBody
+ public AttackResult completed(@RequestParam String url) {
return furBall(url);
}
protected AttackResult furBall(String url) {
try {
- StringBuffer html = new StringBuffer();
+ StringBuffer html = new StringBuffer();
- if (url.matches("http://ifconfig.pro")){
- URL u = new URL(url);
- URLConnection urlConnection = u.openConnection();
- BufferedReader in = new BufferedReader(new InputStreamReader(urlConnection.getInputStream()));
- String inputLine;
-
- while ((inputLine = in.readLine()) != null) {
- html.append(inputLine);
- }
- in.close();
+ if (url.matches("http://ifconfig.pro")) {
+ URL u = new URL(url);
+ URLConnection urlConnection = u.openConnection();
+ BufferedReader in = new BufferedReader(new InputStreamReader(urlConnection.getInputStream()));
+ String inputLine;
- return trackProgress(success()
- .feedback("ssrf.success")
- .output(html.toString())
- .build());
- }else{
- html.append("");
- return trackProgress(failed()
- .feedback("ssrf.failure")
- .output(html.toString())
- .build());
+ while ((inputLine = in.readLine()) != null) {
+ html.append(inputLine);
}
-
- }catch(Exception e) {
- e.printStackTrace();
+ in.close();
+
+ return trackProgress(success()
+ .feedback("ssrf.success")
+ .output(html.toString())
+ .build());
+ } else {
+ html.append("");
return trackProgress(failed()
- .output(e.getMessage())
- .build());
+ .feedback("ssrf.failure")
+ .output(html.toString())
+ .build());
}
+ } catch (Exception e) {
+ e.printStackTrace();
+ return trackProgress(failed()
+ .output(e.getMessage())
+ .build());
+ }
}
}
diff --git a/webgoat-lessons/vulnerable-components/src/main/java/org/owasp/webgoat/plugin/VulnerableComponentsLesson.java b/webgoat-lessons/vulnerable-components/src/main/java/org/owasp/webgoat/plugin/VulnerableComponentsLesson.java
index e3c8a338e..eb25f4ad5 100644
--- a/webgoat-lessons/vulnerable-components/src/main/java/org/owasp/webgoat/plugin/VulnerableComponentsLesson.java
+++ b/webgoat-lessons/vulnerable-components/src/main/java/org/owasp/webgoat/plugin/VulnerableComponentsLesson.java
@@ -5,61 +5,57 @@ import com.thoughtworks.xstream.io.xml.DomDriver;
import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import java.io.IOException;
/**
* *************************************************************************************************
- *
- *
+ *
+ *
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
- *
+ *
* Copyright (c) 2002 - 20014 Bruce Mayhew
- *
+ *
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
- *
+ *
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
- *
+ *
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
- *
+ *
* Getting Source ==============
- *
+ *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* for free software projects.
- *
+ *
* For details, please see http://webgoat.github.io
*
* @author Bruce Mayhew WebGoat
* @created October 28, 2003
*/
-@AssignmentPath("/VulnerableComponents/attack1")
+@RestController
//@AssignmentHints({"http-basics.hints.http_basics_lesson.1"})
public class VulnerableComponentsLesson extends AssignmentEndpoint {
- @RequestMapping(method = RequestMethod.POST)
- public @ResponseBody AttackResult completed(@RequestParam String payload) throws IOException {
-
-
+ @PostMapping("/VulnerableComponents/attack1")
+ public @ResponseBody
+ AttackResult completed(@RequestParam String payload) {
XStream xstream = new XStream(new DomDriver());
xstream.setClassLoader(Contact.class.getClassLoader());
xstream.processAnnotations(Contact.class);
// xstream.registerConverter(new ContactConverter());
// xstream.registerConverter(new CatchAllConverter(), XStream.PRIORITY_VERY_LOW);
-
+
// Contact c = new Contact();
// c.setName("Alvaro");
// String sc = xstream.toXML(c);
@@ -85,16 +81,11 @@ public class VulnerableComponentsLesson extends AssignmentEndpoint {
// System.out.println("Payload:" + payload);
Contact expl = (Contact) xstream.fromXML(payload);
return trackProgress(success().feedback("vulnerable-components.fromXML").feedbackArgs(expl.toString()).build());
-
} catch (com.thoughtworks.xstream.converters.ConversionException ex) {
- if (ex.getMessage().contains("Integer"))
- {
+ if (ex.getMessage().contains("Integer")) {
return trackProgress(success().feedback("vulnerable-components.success").build());
- }
+ }
return trackProgress(failed().feedback("vulnerable-components.close").build());
- }
-
-
-
- }
+ }
+ }
}
diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java
index dd823e1ca..2cd90074d 100644
--- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java
+++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java
@@ -10,10 +10,7 @@ import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.MediaType;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.*;
import javax.annotation.PostConstruct;
import java.io.File;
@@ -49,7 +46,7 @@ import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
* @version $Id: $Id
* @since November 18, 2016
*/
-@AssignmentPath("xxe/blind")
+@RestController
@AssignmentHints({"xxe.blind.hints.1","xxe.blind.hints.2","xxe.blind.hints.3","xxe.blind.hints.4","xxe.blind.hints.5"})
public class BlindSendFileAssignment extends AssignmentEndpoint {
@@ -69,9 +66,9 @@ public class BlindSendFileAssignment extends AssignmentEndpoint {
Files.write(CONTENTS, new File(targetDirectory, "secret.txt"), Charsets.UTF_8);
}
- @RequestMapping(method = RequestMethod.POST, consumes = MediaType.ALL_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
+ @PostMapping(path = "xxe/blind", consumes = MediaType.ALL_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
@ResponseBody
- public AttackResult addComment(@RequestBody String commentStr) throws Exception {
+ public AttackResult addComment(@RequestBody String commentStr) {
//Solution is posted as a separate comment
if (commentStr.contains(CONTENTS)) {
return trackProgress(success().build());
diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/CommentsEndpoint.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/CommentsEndpoint.java
index a46326f44..0528125b3 100644
--- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/CommentsEndpoint.java
+++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/CommentsEndpoint.java
@@ -2,6 +2,7 @@ package org.owasp.webgoat.plugin;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.MediaType;
+import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
@@ -21,7 +22,7 @@ public class CommentsEndpoint {
@Autowired
private Comments comments;
- @RequestMapping(method = GET, produces = MediaType.APPLICATION_JSON_VALUE)
+ @GetMapping(produces = MediaType.APPLICATION_JSON_VALUE)
@ResponseBody
public Collection retrieveComments() {
return comments.getComments();
diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/ContentTypeAssignment.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/ContentTypeAssignment.java
index 4cda99dd3..c2770356e 100644
--- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/ContentTypeAssignment.java
+++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/ContentTypeAssignment.java
@@ -42,14 +42,13 @@ import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;
* @version $Id: $Id
* @since November 17, 2016
*/
-@AssignmentPath("xxe/content-type")
+@RestController
@AssignmentHints({"xxe.hints.content.type.xxe.1", "xxe.hints.content.type.xxe.2"})
public class ContentTypeAssignment extends AssignmentEndpoint {
private final static String[] DEFAULT_LINUX_DIRECTORIES = {"usr", "etc", "var"};
private final static String[] DEFAULT_WINDOWS_DIRECTORIES = {"Windows", "Program Files (x86)", "Program Files"};
-
@Value("${webgoat.server.directory}")
private String webGoatHomeDirectory;
@Autowired
@@ -57,7 +56,7 @@ public class ContentTypeAssignment extends AssignmentEndpoint {
@Autowired
private Comments comments;
- @RequestMapping(method = RequestMethod.POST, consumes = MediaType.ALL_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
+ @PostMapping(path = "xxe/content-type", consumes = MediaType.ALL_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
@ResponseBody
public AttackResult createNewUser(@RequestBody String commentStr, @RequestHeader("Content-Type") String contentType) throws Exception {
AttackResult attackResult = failed().build();
diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java
index acbdeaa68..c9d62f3fe 100644
--- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java
+++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java
@@ -4,17 +4,16 @@ import org.apache.commons.exec.OS;
import org.apache.commons.lang.exception.ExceptionUtils;
import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints;
-import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
+import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
import static org.springframework.http.MediaType.ALL_VALUE;
import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;
-import static org.springframework.web.bind.annotation.RequestMethod.POST;
/**
* ************************************************************************************************
@@ -50,7 +49,7 @@ import static org.springframework.web.bind.annotation.RequestMethod.POST;
* @author nbaars
* @since 4/8/17.
*/
-@AssignmentPath("xxe/simple")
+@RestController
@AssignmentHints({"xxe.hints.simple.xxe.1", "xxe.hints.simple.xxe.2", "xxe.hints.simple.xxe.3", "xxe.hints.simple.xxe.4", "xxe.hints.simple.xxe.5", "xxe.hints.simple.xxe.6"})
public class SimpleXXE extends AssignmentEndpoint {
@@ -62,7 +61,7 @@ public class SimpleXXE extends AssignmentEndpoint {
@Autowired
private Comments comments;
- @RequestMapping(method = POST, consumes = ALL_VALUE, produces = APPLICATION_JSON_VALUE)
+ @PostMapping(path = "xxe/simple", consumes = ALL_VALUE, produces = APPLICATION_JSON_VALUE)
@ResponseBody
public AttackResult createNewComment(@RequestBody String commentStr) throws Exception {
String error = "";
@@ -77,12 +76,13 @@ public class SimpleXXE extends AssignmentEndpoint {
}
return trackProgress(failed().output(error).build());
}
+
private boolean checkSolution(Comment comment) {
- String[] directoriesToCheck = OS.isFamilyMac() || OS.isFamilyUnix() ? DEFAULT_LINUX_DIRECTORIES : DEFAULT_WINDOWS_DIRECTORIES;
- boolean success = true;
- for (String directory : directoriesToCheck) {
- success &= org.apache.commons.lang3.StringUtils.contains(comment.getText(), directory);
- }
- return success;
- }
+ String[] directoriesToCheck = OS.isFamilyMac() || OS.isFamilyUnix() ? DEFAULT_LINUX_DIRECTORIES : DEFAULT_WINDOWS_DIRECTORIES;
+ boolean success = true;
+ for (String directory : directoriesToCheck) {
+ success &= org.apache.commons.lang3.StringUtils.contains(comment.getText(), directory);
+ }
+ return success;
+ }
}
diff --git a/webwolf/src/main/java/org/owasp/webwolf/MvcConfiguration.java b/webwolf/src/main/java/org/owasp/webwolf/MvcConfiguration.java
index e3582b696..0a03bcf31 100644
--- a/webwolf/src/main/java/org/owasp/webwolf/MvcConfiguration.java
+++ b/webwolf/src/main/java/org/owasp/webwolf/MvcConfiguration.java
@@ -38,6 +38,4 @@ public class MvcConfiguration extends WebMvcConfigurerAdapter {
file.mkdirs();
}
}
-
-
}
\ No newline at end of file
diff --git a/webwolf/src/main/java/org/owasp/webwolf/WebSecurityConfig.java b/webwolf/src/main/java/org/owasp/webwolf/WebSecurityConfig.java
index 9639bac3f..eee7953cb 100644
--- a/webwolf/src/main/java/org/owasp/webwolf/WebSecurityConfig.java
+++ b/webwolf/src/main/java/org/owasp/webwolf/WebSecurityConfig.java
@@ -35,12 +35,14 @@ import org.owasp.webwolf.user.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.password.NoOpPasswordEncoder;
/**
* Security configuration for WebGoat.
@@ -81,4 +83,15 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
public UserDetailsService userDetailsServiceBean() throws Exception {
return userDetailsService;
}
+
+ @Override
+ @Bean
+ protected AuthenticationManager authenticationManager() throws Exception {
+ return super.authenticationManager();
+ }
+
+ @Bean
+ public NoOpPasswordEncoder passwordEncoder() {
+ return (NoOpPasswordEncoder) NoOpPasswordEncoder.getInstance();
+ }
}
\ No newline at end of file
diff --git a/webwolf/src/main/java/org/owasp/webwolf/WebWolf.java b/webwolf/src/main/java/org/owasp/webwolf/WebWolf.java
index 1153f14cb..7eb2fb2de 100644
--- a/webwolf/src/main/java/org/owasp/webwolf/WebWolf.java
+++ b/webwolf/src/main/java/org/owasp/webwolf/WebWolf.java
@@ -2,18 +2,15 @@ package org.owasp.webwolf;
import org.owasp.webwolf.requests.WebWolfTraceRepository;
import org.springframework.boot.SpringApplication;
-import org.springframework.boot.actuate.trace.TraceRepository;
+import org.springframework.boot.actuate.trace.http.HttpTraceRepository;
import org.springframework.boot.autoconfigure.SpringBootApplication;
-import org.springframework.boot.builder.SpringApplicationBuilder;
import org.springframework.context.annotation.Bean;
-import java.util.Map;
-
@SpringBootApplication
public class WebWolf {
@Bean
- public TraceRepository traceRepository() {
+ public HttpTraceRepository traceRepository() {
return new WebWolfTraceRepository();
}
diff --git a/webwolf/src/main/java/org/owasp/webwolf/requests/Requests.java b/webwolf/src/main/java/org/owasp/webwolf/requests/Requests.java
index 7bf9bd162..67f8a4e39 100644
--- a/webwolf/src/main/java/org/owasp/webwolf/requests/Requests.java
+++ b/webwolf/src/main/java/org/owasp/webwolf/requests/Requests.java
@@ -5,14 +5,13 @@ import com.fasterxml.jackson.databind.ObjectMapper;
import lombok.AllArgsConstructor;
import lombok.Getter;
import lombok.extern.slf4j.Slf4j;
-import org.springframework.boot.actuate.trace.Trace;
+import org.springframework.boot.actuate.trace.http.HttpTrace;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.servlet.ModelAndView;
-import javax.servlet.http.HttpServletRequest;
-import java.util.Date;
+import java.time.Instant;
import java.util.List;
import static java.util.stream.Collectors.toList;
@@ -36,7 +35,7 @@ public class Requests {
@AllArgsConstructor
@Getter
private class Tracert {
- private final Date date;
+ private final Instant date;
private final String path;
private final String json;
}
@@ -51,13 +50,13 @@ public class Requests {
return m;
}
- private String path(Trace t) {
- return (String) t.getInfo().getOrDefault("path", "");
+ private String path(HttpTrace t) {
+ return (String) t.getRequest().getUri().getPath();
}
- private String toJsonString(Trace t) {
+ private String toJsonString(HttpTrace t) {
try {
- return objectMapper.writeValueAsString(t.getInfo());
+ return objectMapper.writeValueAsString(t);
} catch (JsonProcessingException e) {
log.error("Unable to create json", e);
}
diff --git a/webwolf/src/main/java/org/owasp/webwolf/requests/WebWolfTraceRepository.java b/webwolf/src/main/java/org/owasp/webwolf/requests/WebWolfTraceRepository.java
index d08ed00f6..07bce17dc 100644
--- a/webwolf/src/main/java/org/owasp/webwolf/requests/WebWolfTraceRepository.java
+++ b/webwolf/src/main/java/org/owasp/webwolf/requests/WebWolfTraceRepository.java
@@ -2,15 +2,11 @@ package org.owasp.webwolf.requests;
import com.google.common.collect.EvictingQueue;
import com.google.common.collect.Lists;
-import com.google.common.collect.Maps;
import lombok.extern.slf4j.Slf4j;
-import org.springframework.boot.actuate.trace.Trace;
-import org.springframework.boot.actuate.trace.TraceRepository;
+import org.springframework.boot.actuate.trace.http.HttpTrace;
+import org.springframework.boot.actuate.trace.http.HttpTraceRepository;
-import java.util.Date;
-import java.util.HashMap;
import java.util.List;
-import java.util.Map;
/**
* Keep track of all the incoming requests, we are only keeping track of request originating from
@@ -20,20 +16,17 @@ import java.util.Map;
* @since 8/13/17.
*/
@Slf4j
-public class WebWolfTraceRepository implements TraceRepository {
+public class WebWolfTraceRepository implements HttpTraceRepository {
- private final EvictingQueue traces = EvictingQueue.create(10000);
+ private final EvictingQueue traces = EvictingQueue.create(10000);
private List exclusionList = Lists.newArrayList("/WebWolf/home", "/WebWolf/mail", "/WebWolf/files", "/images/", "/login", "/favicon.ico", "/js/", "/webjars/", "/WebWolf/requests", "/css/", "/mail");
@Override
- public List findAll() {
- HashMap map = Maps.newHashMap();
- map.put("nice", "Great you found the standard Spring Boot tracing endpoint!");
- Trace trace = new Trace(new Date(), map);
- return Lists.newArrayList(trace);
+ public List findAll() {
+ return List.of();
}
- public List findAllTraces() {
+ public List findAllTraces() {
return Lists.newArrayList(traces);
}
@@ -42,10 +35,10 @@ public class WebWolfTraceRepository implements TraceRepository {
}
@Override
- public void add(Map map) {
- String path = (String) map.getOrDefault("path", "");
+ public void add(HttpTrace httpTrace) {
+ var path = httpTrace.getRequest().getUri().getPath();
if (!isInExclusionList(path)) {
- traces.add(new Trace(new Date(), map));
+ traces.add(httpTrace);
}
}
}
diff --git a/webwolf/src/main/resources/application-webwolf.properties b/webwolf/src/main/resources/application-webwolf.properties
index cb3c0f617..d73721503 100644
--- a/webwolf/src/main/resources/application-webwolf.properties
+++ b/webwolf/src/main/resources/application-webwolf.properties
@@ -21,7 +21,6 @@ endpoints.trace.sensitive=false
management.trace.include=REQUEST_HEADERS,RESPONSE_HEADERS,COOKIES,ERRORS,TIME_TAKEN,PARAMETERS,QUERY_STRING
endpoints.trace.enabled=true
-spring.resources.cache-period=0
spring.thymeleaf.cache=false
multipart.enabled=true