From 6327b822048de7b44eba95e212d987ede7a0b7f3 Mon Sep 17 00:00:00 2001
From: Philippe Steinbach <steinbach.phil@gmail.com>
Date: Mon, 26 Nov 2018 15:27:15 +0100
Subject: [PATCH] ace editor text as request parameter

---
 .../html/CrossSiteScriptingMitigation.html       |  2 +-
 .../src/main/resources/js/assignment3.js         | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)
 create mode 100644 webgoat-lessons/cross-site-scripting/src/main/resources/js/assignment3.js

diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScriptingMitigation.html b/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScriptingMitigation.html
index bd1d41d11..f8729a0c8 100644
--- a/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScriptingMitigation.html
+++ b/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScriptingMitigation.html
@@ -18,7 +18,7 @@
 			<div>
 				<div id="editor" style="position: absolute; top: 0; right: 0; bottom: 0; left: 0;" name="editor"></div>
 				<script th:src="@{/js/libs/ace/src-noconflict/ace.js}" type="text/javascript" charset="utf-8"></script>
-				<script th:src="@{/lesson_js/assignment10b.js}" type="text/javascript" charset="utf-8"></script>
+				<script th:src="@{/lesson_js/assignment3.js}" type="text/javascript" charset="utf-8"></script>
 				<script>
                     var editor = ace.edit("editor");
                     editor.setTheme("ace/theme/monokai");
diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/js/assignment3.js b/webgoat-lessons/cross-site-scripting/src/main/resources/js/assignment3.js
new file mode 100644
index 000000000..92258e0be
--- /dev/null
+++ b/webgoat-lessons/cross-site-scripting/src/main/resources/js/assignment3.js
@@ -0,0 +1,16 @@
+function ace_collect() {
+    let code = "";
+    $(".ace_line").each(function(i, el) {
+        code += el.innerHTML;
+    });
+    console.log(code);
+    code = $(".ace_content")[0].innerHTML;
+    $.ajax({
+        type: "POST",
+        url: "/WebGoat/CrossSiteScripting/attack3",
+        dataType: "text",
+        data: {
+            editor: code
+        }
+    });
+}
\ No newline at end of file