diff --git a/README.MD b/README.MD index f992a45d8..9b0b399a5 100644 --- a/README.MD +++ b/README.MD @@ -52,15 +52,27 @@ The "Easy Run" JAR file offers a no hassle approach to testing and running WebGo wish to simply try/test/run the current development version of WebGoat ### Prerequisites: -* Java VM 1.8 installed +* Java VM 1.8 or Docker installed ## Easy Run Instructions: -#### 1. Download the easy run executable jar file which contains all the lessons and a embedded Tomcat server: +#### 1. Docker image + +The latest version of WebGoat is available at DockerHub, see [https://hub.docker.com/r/webgoat/webgoat-container/](https://hub.docker.com/r/webgoat/webgoat-container/). +First install Docker, then open a command shell/window and type: + +```Shell +docker pull webgoat/webgoat-container +docker run -p 8080:8080 webgoat/webgoat-container +``` + +Wait for the Docker container to start and go to step 3. + +#### 2. Download the easy run executable jar file which contains all the lessons and a embedded Tomcat server: https://s3.amazonaws.com/webgoat-war/webgoat-container-7.0.1-war-exec.jar -#### 2. Run it using java: +#### 3. Run it using java: Open a command shell/window, browse to where you downloaded the easy run jar and type: @@ -177,13 +189,17 @@ To be able to see which labels are loaded through a property file, open up the d After the reload is complete, all labels which are loaded from a property file will be __marked green__. -## Docker support +## Building a new Docker image WebGoat now has Docker support you can build a container with the following commands: ```Shell -cd WebGoat -mvn -pl webgoat-container package docker:build +cd WebGoat/ +mvn package +cd webgoat-container +mvn docker:build +docker login +docker push webgoat/webgoat-container ``` With the following command you are able to run the Docker container on your local machine: @@ -193,5 +209,4 @@ docker run -p 8080:8080 -t webgoat/webgoat-container docker ps ``` -With the last command you are able to determine ip address to connect to. -At the moment the Docker image is not distributed to a Docker registry. \ No newline at end of file +With the last command you are able to determine ip address to connect to. \ No newline at end of file diff --git a/pom.xml b/pom.xml index 6766418e5..3e0e29981 100644 --- a/pom.xml +++ b/pom.xml @@ -129,7 +129,6 @@ 3.4 1.2 4.0.0 - 1.4.2 18.0 1.4.190 1.8.0.10 diff --git a/webgoat-container/pom.xml b/webgoat-container/pom.xml index 95d366f88..852103c6e 100644 --- a/webgoat-container/pom.xml +++ b/webgoat-container/pom.xml @@ -252,11 +252,6 @@ wsdl4j ${wsdl4j.version} - - ecs - ecs - ${ecs.version} - javax.transaction javax.transaction-api diff --git a/webgoat-container/src/main/docker/Dockerfile b/webgoat-container/src/main/docker/Dockerfile index 76058806e..a33389017 100644 --- a/webgoat-container/src/main/docker/Dockerfile +++ b/webgoat-container/src/main/docker/Dockerfile @@ -1,5 +1,6 @@ FROM frolvlad/alpine-oraclejdk8:slim VOLUME /tmp +RUN cd /root; mkdir -p .webgoat ADD webgoat-container-8.0-SNAPSHOT.war webgoat.jar RUN sh -c 'touch /webgoat.jar' ENTRYPOINT ["java","-Djava.security.egd=file:/dev/./urandom","-jar","/webgoat.jar"] \ No newline at end of file diff --git a/webgoat-container/src/main/resources/templates/login.html b/webgoat-container/src/main/resources/templates/login.html index 74c989747..a7c7095c4 100644 --- a/webgoat-container/src/main/resources/templates/login.html +++ b/webgoat-container/src/main/resources/templates/login.html @@ -37,7 +37,7 @@
- +
diff --git a/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/Salaries.java b/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/Salaries.java index 5f20f1e69..1fa3d0cc2 100644 --- a/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/Salaries.java +++ b/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/Salaries.java @@ -4,12 +4,11 @@ package org.owasp.webgoat.plugin; * */ -import org.apache.ecs.html.TD; -import org.apache.ecs.html.TR; -import org.apache.ecs.html.Table; +import com.google.common.collect.Lists; +import com.google.common.collect.Maps; import org.owasp.webgoat.lessons.Endpoint; import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.ResponseBody; import org.w3c.dom.Node; import org.w3c.dom.NodeList; import org.xml.sax.InputSource; @@ -24,11 +23,14 @@ import javax.xml.xpath.XPathFactory; import java.io.File; import java.io.FileInputStream; import java.io.IOException; +import java.util.List; +import java.util.Map; public class Salaries extends Endpoint { - @RequestMapping(method = RequestMethod.GET) - public void invoke(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + @RequestMapping(produces = {"application/json"}) + @ResponseBody + public List> invoke(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { String userId = req.getParameter("userId"); NodeList nodes = null; File d = new File(getPluginDirectory(), "ClientSideFiltering/html/employees.xml"); @@ -52,49 +54,18 @@ public class Salaries extends Endpoint { } catch (XPathExpressionException e) { e.printStackTrace(); } - int nodesLength = nodes.getLength(); - - - TR tr; - int COLUMNS = 5; - - Table t2 = null; - if (nodesLength > 0) { - t2 = new Table().setCellSpacing(0).setCellPadding(0) - .setBorder(1).setWidth("90%").setAlign("center"); - tr = new TR(); - tr.addElement(new TD().addElement("UserID")); - tr.addElement(new TD().addElement("First Name")); - tr.addElement(new TD().addElement("Last Name")); - tr.addElement(new TD().addElement("SSN")); - tr.addElement(new TD().addElement("Salary")); - t2.addElement(tr); - } - - tr = new TR(); - - for (int i = 0; i < nodesLength; i++) { + List json = Lists.newArrayList(); + java.util.Map employeeJson = Maps.newHashMap(); + for (int i = 0; i < nodes.getLength(); i++) { + if (i != 0 && i % COLUMNS == 0) { + employeeJson = Maps.newHashMap(); + json.add(employeeJson); + } Node node = nodes.item(i); - - if (i % COLUMNS == 0) { - tr = new TR(); - tr.setID(node.getTextContent()); - //tr.setStyle("display: none"); - } - - tr.addElement(new TD().addElement(node.getTextContent())); - - if (i % COLUMNS == (COLUMNS - 1)) { - t2.addElement(tr); - } - } - - if (t2 != null) { - resp.getWriter().println(t2.toString()); - } else { - resp.getWriter().println("No Results"); + employeeJson.put(node.getNodeName(), node.getTextContent()); } + return json; } @Override diff --git a/webgoat-lessons/client-side-filtering/src/main/resources/plugin/ClientSideFiltering/html/employees.xml b/webgoat-lessons/client-side-filtering/src/main/resources/plugin/ClientSideFiltering/html/employees.xml index 31b95296b..e7c4b0246 100644 --- a/webgoat-lessons/client-side-filtering/src/main/resources/plugin/ClientSideFiltering/html/employees.xml +++ b/webgoat-lessons/client-side-filtering/src/main/resources/plugin/ClientSideFiltering/html/employees.xml @@ -1,6 +1,6 @@ - + 101 Larry Stooge @@ -19,7 +19,7 @@ 102 111 112 - + 102 @@ -37,8 +37,8 @@ Hit Curly over head 101013 - 112 - + 112 + 103 @@ -59,7 +59,7 @@ 102 111 112 - + 104 @@ -81,7 +81,7 @@ 102 111 112 - + 105 @@ -103,7 +103,7 @@ 102 111 112 - + 106 @@ -124,7 +124,7 @@ 102 111 112 - + 107 @@ -145,7 +145,7 @@ 102 111 112 - + 108 @@ -167,7 +167,7 @@ 102 111 112 - + 109 @@ -189,7 +189,7 @@ 102 111 112 - + 110 @@ -211,7 +211,7 @@ 102 111 112 - + 111 @@ -230,7 +230,7 @@ 112005 112 - + 112 @@ -246,9 +246,9 @@ 300 - 112005 + 112005 - 112 - + 112 + diff --git a/webgoat-lessons/client-side-filtering/src/main/resources/plugin/ClientSideFiltering/js/clientSideFiltering.js b/webgoat-lessons/client-side-filtering/src/main/resources/plugin/ClientSideFiltering/js/clientSideFiltering.js index 11fd03544..79694e532 100644 --- a/webgoat-lessons/client-side-filtering/src/main/resources/plugin/ClientSideFiltering/js/clientSideFiltering.js +++ b/webgoat-lessons/client-side-filtering/src/main/resources/plugin/ClientSideFiltering/js/clientSideFiltering.js @@ -15,8 +15,27 @@ function fetchUserData() { function ajaxFunction(userId) { $.get("clientSideFiltering/salaries?userId=" + userId, function (result, status) { + var html = "'; + html = html + ''; + html = html + ''; + html = html + ''; + html = html + ''; + html = html + ''; + + for (var i = 0; i < result.length; i++) { + html = html + ''; + html = html + ''; + html = html + ''; + html = html + ''; + html = html + ''; + html = html + ''; + html = html + ''; + } + html = html + '
UserIDFirst NameLast NameSSNSalary
' + result[i].UserID + '' + result[i].FirstName + '' + result[i].LastName + '' + result[i].SSN + '' + result[i].Salary + '
'; + var newdiv = document.createElement("div"); - newdiv.innerHTML = result; + newdiv.innerHTML = html; var container = document.getElementById("hiddenEmployeeRecords"); container.appendChild(newdiv); });