+ * Copyright (c) 2002 - 20014 Bruce Mayhew + *
+ * This program is free software; you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + *
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + *
+ * You should have received a copy of the GNU General Public License along with this program; if + * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA + * 02111-1307, USA. + *
+ * Getting Source ============== + *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software + * projects. + *
+ *
+ * @author WebGoat
+ * @since December 12, 2015
+ * @version $Id: $Id
+ */
+package org.owasp.webgoat;
+
+import com.google.common.collect.Maps;
+import com.google.common.collect.Sets;
+import org.asciidoctor.Asciidoctor;
+import org.thymeleaf.TemplateProcessingParameters;
+import org.thymeleaf.resourceresolver.IResourceResolver;
+import org.thymeleaf.templateresolver.TemplateResolver;
+
+import java.io.ByteArrayInputStream;
+import java.io.File;
+import java.io.FileReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.StringWriter;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Optional;
+
+import static org.asciidoctor.Asciidoctor.Factory.create;
+
+/**
+ * Thymeleaf resolver for AsciiDoc used in the lesson, can be used as follows inside a lesson file:
+ *
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ *
+ *
+ * @author WebGoat
+ * @since December 12, 2015
+ * @version $Id: $Id
+ */
package org.owasp.webgoat;
import org.springframework.beans.factory.annotation.Autowired;
@@ -10,6 +40,9 @@ import org.springframework.security.config.annotation.web.configuration.WebSecur
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
import org.springframework.security.core.userdetails.UserDetailsService;
+/**
+ * Security configuration for WebGoat.
+ */
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/application/WebGoatServletListener.java b/webgoat-container/src/main/java/org/owasp/webgoat/application/WebGoatServletListener.java
deleted file mode 100644
index a3a1682ae..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/application/WebGoatServletListener.java
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * To change this license header, choose License Headers in Project Properties.
- * To change this template file, choose Tools | Templates
- * and open the template in the editor.
- */
-package org.owasp.webgoat.application;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.servlet.ServletContext;
-import javax.servlet.ServletContextEvent;
-import javax.servlet.ServletContextListener;
-import java.sql.Driver;
-import java.sql.DriverManager;
-import java.sql.SQLException;
-import java.util.Enumeration;
-
-/**
- * Web application lifecycle listener.
- *
- * @author rlawson
- * @version $Id: $Id
- */
-public class WebGoatServletListener implements ServletContextListener {
-
- private static final Logger logger = LoggerFactory.getLogger(WebGoatServletListener.class);
-
- /** {@inheritDoc} */
- @Override
- public void contextInitialized(ServletContextEvent sce) {
- ServletContext context = sce.getServletContext();
- context.log("WebGoat is starting");
- }
-
- /** {@inheritDoc} */
- @Override
- public void contextDestroyed(ServletContextEvent sce) {
- ServletContext context = sce.getServletContext();
- context.log("WebGoat is stopping");
-
- // Unregister JDBC drivers in this context's ClassLoader:
- // Get the webapp's ClassLoader
- ClassLoader cl = Thread.currentThread().getContextClassLoader();
- // Loop through all drivers
- Enumeration Start class. start.
+ *
+ *
+ */
+public class AsciiDoctorTemplateResolver extends TemplateResolver {
+
+ private static final Asciidoctor asciidoctor = create();
+ private static final String PREFIX = "doc:";
+ private final File pluginTargetDirectory;
+
+ public AsciiDoctorTemplateResolver(File pluginTargetDirectory) {
+ this.pluginTargetDirectory = pluginTargetDirectory;
+ setResourceResolver(new AdocResourceResolver());
+ setResolvablePatterns(Sets.newHashSet(PREFIX + "*"));
+ }
+
+ @Override
+ protected String computeResourceName(TemplateProcessingParameters params) {
+ String templateName = params.getTemplateName();
+ return templateName.substring(PREFIX.length());
+ }
+
+ private class AdocResourceResolver implements IResourceResolver {
+
+ @Override
+ public InputStream getResourceAsStream(TemplateProcessingParameters params, String resourceName) {
+ try {
+ Optional
+ *
+ *
+ *
+ * Thymeleaf will invoke this resolver based on the prefix and this implementqtion will resolve the html in the plugins directory
*/
public class LessonTemplateResolver extends TemplateResolver {
-
private final static String PREFIX = "lesson:";
private final File pluginTargetDirectory;
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/MvcConfiguration.java b/webgoat-container/src/main/java/org/owasp/webgoat/MvcConfiguration.java
index 8b573d165..98e8d0b28 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/MvcConfiguration.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/MvcConfiguration.java
@@ -1,3 +1,33 @@
+/**
+ *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ *
+ * @author WebGoat
+ * @since October 28, 2003
+ * @version $Id: $Id
+ */
package org.owasp.webgoat;
import com.google.common.collect.Sets;
@@ -20,7 +50,7 @@ import org.thymeleaf.templateresolver.TemplateResolver;
import java.io.File;
/**
- *
+ * Configuration for Spring MVC
*/
@Configuration
public class MvcConfiguration extends WebMvcConfigurerAdapter {
@@ -50,15 +80,26 @@ public class MvcConfiguration extends WebMvcConfigurerAdapter {
public LessonTemplateResolver lessonTemplateResolver() {
LessonTemplateResolver resolver = new LessonTemplateResolver(pluginTargetDirectory);
resolver.setOrder(2);
+ resolver.setCacheable(false);
return resolver;
}
@Bean
- public SpringTemplateEngine thymeleafTemplateEngine(TemplateResolver springThymeleafTemplateResolver, LessonTemplateResolver lessonTemplateResolver) {
+ public AsciiDoctorTemplateResolver asciiDoctorTemplateResolver() {
+ AsciiDoctorTemplateResolver resolver = new AsciiDoctorTemplateResolver(pluginTargetDirectory);
+ resolver.setCacheable(true);
+ resolver.setOrder(3);
+ return resolver;
+ }
+
+ @Bean
+ public SpringTemplateEngine thymeleafTemplateEngine(TemplateResolver springThymeleafTemplateResolver,
+ LessonTemplateResolver lessonTemplateResolver,
+ AsciiDoctorTemplateResolver asciiDoctorTemplateResolver) {
SpringTemplateEngine engine = new SpringTemplateEngine();
engine.addDialect(new SpringSecurityDialect());
engine.setTemplateResolvers(
- Sets.newHashSet(springThymeleafTemplateResolver, lessonTemplateResolver));
+ Sets.newHashSet(springThymeleafTemplateResolver, lessonTemplateResolver, asciiDoctorTemplateResolver));
return engine;
}
@@ -68,6 +109,11 @@ public class MvcConfiguration extends WebMvcConfigurerAdapter {
return new ServletRegistrationBean(hammerHead, "/attack/*");
}
+ /**
+ * This way we expose the plugins target directory as a resource within the web application.
+ *
+ * @param registry
+ */
@Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {
registry.addResourceHandler("/plugin_lessons/**").addResourceLocations("file:///" + pluginTargetDirectory.toString() + "/");
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/WebGoat.java b/webgoat-container/src/main/java/org/owasp/webgoat/WebGoat.java
index acc7484b2..009f36180 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/WebGoat.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/WebGoat.java
@@ -1,3 +1,33 @@
+/**
+ *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ *
+ * @author WebGoat
+ * @since October 28, 2003
+ * @version $Id: $Id
+ */
package org.owasp.webgoat;
import org.owasp.webgoat.plugins.PluginClassLoader;
@@ -53,7 +83,7 @@ public class WebGoat extends SpringBootServletInitializer {
@Bean
@Scope(value = "session", proxyMode = ScopedProxyMode.TARGET_CLASS)
- public WebSession webSession(Course course, WebgoatContext webgoatContext, ServletContext context, ApplicationContext applicationContext ) {
+ public WebSession webSession(Course course, WebgoatContext webgoatContext, ServletContext context) {
return new WebSession(course, webgoatContext, context);
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/WebSecurityConfig.java b/webgoat-container/src/main/java/org/owasp/webgoat/WebSecurityConfig.java
index eab88881c..bd1e5a5f8 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/WebSecurityConfig.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/WebSecurityConfig.java
@@ -1,3 +1,33 @@
+
+/**
+ *************************************************************************************************
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ *
-
-
+
+
+