Refactoring (#1201)
* Some initial refactoring * Make it one application * Got it working * Fix problem on Windows * Move WebWolf * Move first lesson * Moved all lessons * Fix pom.xml * Fix tests * Add option to initialize a lesson This way we can create content for each user inside a lesson. The initialize method will be called when a new user is created or when a lesson reset happens * Clean up pom.xml files * Remove fetching labels based on language. We only support English at the moment, all the lesson explanations are written in English which makes it very difficult to translate. If we only had labels it would make sense to support multiple languages * Fix SonarLint issues * And move it all to the main project * Fix for documentation paths * Fix pom warnings * Remove PMD as it does not work * Update release notes about refactoring Update release notes about refactoring Update release notes about refactoring * Fix lesson template * Update release notes * Keep it in the same repo in Dockerhub * Update documentation to show how the connection is obtained. Resolves: #1180 * Rename all integration tests * Remove command from Dockerfile * Simplify GitHub actions Currently, we use a separate actions for pull-requests and branch build. This is now consolidated in one action. The PR action triggers always, it now only trigger when the PR is opened and not in draft. Running all platforms on a branch build is a bit too much, it is better to only run all platforms when someone opens a PR. * Remove duplicate entry from release notes * Add explicit registry for base image * Lesson scanner not working when fat jar When running the fat jar we have to take into account we are reading from the jar file and not the filesystem. In this case you cannot use `getFile` for example. * added info in README and fixed release docker * changed base image and added ignore file Co-authored-by: Zubcevic.com <rene@zubcevic.com>
This commit is contained in:
Nanne Baars
GitHub
@ -0,0 +1,91 @@
|
||||
/*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
* <p>
|
||||
* Copyright (c) 2002 - 2017 Bruce Mayhew
|
||||
* <p>
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
* <p>
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
* <p>
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
* <p>
|
||||
* Getting Source ==============
|
||||
* <p>
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
* <p>
|
||||
*/
|
||||
|
||||
package org.owasp.webgoat.container.assignments;
|
||||
|
||||
import lombok.Getter;
|
||||
import org.owasp.webgoat.container.i18n.PluginMessages;
|
||||
import org.owasp.webgoat.container.lessons.Initializeable;
|
||||
import org.owasp.webgoat.container.session.UserSessionData;
|
||||
import org.owasp.webgoat.container.session.WebSession;
|
||||
import org.owasp.webgoat.container.users.WebGoatUser;
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
|
||||
public abstract class AssignmentEndpoint implements Initializeable {
|
||||
|
||||
@Autowired
|
||||
private WebSession webSession;
|
||||
@Autowired
|
||||
private UserSessionData userSessionData;
|
||||
@Getter
|
||||
@Autowired
|
||||
private PluginMessages messages;
|
||||
|
||||
protected WebSession getWebSession() {
|
||||
return webSession;
|
||||
}
|
||||
|
||||
protected UserSessionData getUserSessionData() {
|
||||
return userSessionData;
|
||||
}
|
||||
|
||||
/**
|
||||
* Convenience method for create a successful result:
|
||||
* <p>
|
||||
* - Assignment is set to solved
|
||||
* - Feedback message is set to 'assignment.solved'
|
||||
* <p>
|
||||
* Of course you can overwrite these values in a specific lesson
|
||||
*
|
||||
* @return a builder for creating a result from a lesson
|
||||
* @param assignment
|
||||
*/
|
||||
protected AttackResult.AttackResultBuilder success(AssignmentEndpoint assignment) {
|
||||
return AttackResult.builder(messages).lessonCompleted(true).attemptWasMade().feedback("assignment.solved").assignment(assignment);
|
||||
}
|
||||
|
||||
/**
|
||||
* Convenience method for create a failed result:
|
||||
* <p>
|
||||
* - Assignment is set to not solved
|
||||
* - Feedback message is set to 'assignment.not.solved'
|
||||
* <p>
|
||||
* Of course you can overwrite these values in a specific lesson
|
||||
*
|
||||
* @return a builder for creating a result from a lesson
|
||||
* @param assignment
|
||||
*/
|
||||
protected AttackResult.AttackResultBuilder failed(AssignmentEndpoint assignment) {
|
||||
return AttackResult.builder(messages).lessonCompleted(false).attemptWasMade().feedback("assignment.not.solved").assignment(assignment);
|
||||
}
|
||||
|
||||
protected AttackResult.AttackResultBuilder informationMessage(AssignmentEndpoint assignment) {
|
||||
return AttackResult.builder(messages).lessonCompleted(false).assignment(assignment);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void initialize(WebGoatUser user) {
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,16 @@
|
||||
package org.owasp.webgoat.container.assignments;
|
||||
|
||||
import java.lang.annotation.ElementType;
|
||||
import java.lang.annotation.Retention;
|
||||
import java.lang.annotation.RetentionPolicy;
|
||||
import java.lang.annotation.Target;
|
||||
|
||||
/**
|
||||
* Created by nbaars on 1/14/17.
|
||||
*/
|
||||
@Target(ElementType.TYPE)
|
||||
@Retention(RetentionPolicy.RUNTIME)
|
||||
public @interface AssignmentHints {
|
||||
|
||||
String[] value() default {};
|
||||
}
|
||||
@ -0,0 +1,22 @@
|
||||
package org.owasp.webgoat.container.assignments;
|
||||
|
||||
import org.springframework.web.bind.annotation.RequestMethod;
|
||||
|
||||
import java.lang.annotation.ElementType;
|
||||
import java.lang.annotation.Retention;
|
||||
import java.lang.annotation.RetentionPolicy;
|
||||
import java.lang.annotation.Target;
|
||||
|
||||
/**
|
||||
* Created by nbaars on 1/14/17.
|
||||
*/
|
||||
@Target(ElementType.TYPE)
|
||||
@Retention(RetentionPolicy.RUNTIME)
|
||||
public @interface AssignmentPath {
|
||||
|
||||
String[] path() default {};
|
||||
|
||||
RequestMethod[] method() default {};
|
||||
|
||||
String value() default "";
|
||||
}
|
||||
@ -0,0 +1,124 @@
|
||||
/*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
* <p>
|
||||
* Copyright (c) 2002 - 2017 Bruce Mayhew
|
||||
* <p>
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
* <p>
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
* <p>
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
* <p>
|
||||
* Getting Source ==============
|
||||
* <p>
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
* <p>
|
||||
*/
|
||||
|
||||
package org.owasp.webgoat.container.assignments;
|
||||
|
||||
import lombok.Getter;
|
||||
import org.owasp.webgoat.container.i18n.PluginMessages;
|
||||
|
||||
import static org.apache.commons.text.StringEscapeUtils.escapeJson;
|
||||
|
||||
public class AttackResult {
|
||||
|
||||
|
||||
public static class AttackResultBuilder {
|
||||
|
||||
private boolean lessonCompleted;
|
||||
private PluginMessages messages;
|
||||
private Object[] feedbackArgs;
|
||||
private String feedbackResourceBundleKey;
|
||||
private String output;
|
||||
private Object[] outputArgs;
|
||||
private AssignmentEndpoint assignment;
|
||||
private boolean attemptWasMade = false;
|
||||
|
||||
public AttackResultBuilder(PluginMessages messages) {
|
||||
this.messages = messages;
|
||||
}
|
||||
|
||||
public AttackResultBuilder lessonCompleted(boolean lessonCompleted) {
|
||||
this.lessonCompleted = lessonCompleted;
|
||||
this.feedbackResourceBundleKey = "lesson.completed";
|
||||
return this;
|
||||
}
|
||||
|
||||
public AttackResultBuilder lessonCompleted(boolean lessonCompleted, String resourceBundleKey) {
|
||||
this.lessonCompleted = lessonCompleted;
|
||||
this.feedbackResourceBundleKey = resourceBundleKey;
|
||||
return this;
|
||||
}
|
||||
|
||||
public AttackResultBuilder feedbackArgs(Object... args) {
|
||||
this.feedbackArgs = args;
|
||||
return this;
|
||||
}
|
||||
|
||||
public AttackResultBuilder feedback(String resourceBundleKey) {
|
||||
this.feedbackResourceBundleKey = resourceBundleKey;
|
||||
return this;
|
||||
}
|
||||
|
||||
public AttackResultBuilder output(String output) {
|
||||
this.output = output;
|
||||
return this;
|
||||
}
|
||||
|
||||
public AttackResultBuilder outputArgs(Object... args) {
|
||||
this.outputArgs = args;
|
||||
return this;
|
||||
}
|
||||
|
||||
public AttackResultBuilder attemptWasMade() {
|
||||
this.attemptWasMade = true;
|
||||
return this;
|
||||
}
|
||||
|
||||
public AttackResult build() {
|
||||
return new AttackResult(lessonCompleted, messages.getMessage(feedbackResourceBundleKey, feedbackArgs), messages.getMessage(output, output, outputArgs), assignment.getClass().getSimpleName(), attemptWasMade);
|
||||
}
|
||||
|
||||
public AttackResultBuilder assignment(AssignmentEndpoint assignment) {
|
||||
this.assignment = assignment;
|
||||
return this;
|
||||
}
|
||||
}
|
||||
|
||||
@Getter
|
||||
private boolean lessonCompleted;
|
||||
@Getter
|
||||
private String feedback;
|
||||
@Getter
|
||||
private String output;
|
||||
@Getter
|
||||
private final String assignment;
|
||||
@Getter
|
||||
private boolean attemptWasMade;
|
||||
|
||||
public AttackResult(boolean lessonCompleted, String feedback, String output, String assignment, boolean attemptWasMade) {
|
||||
this.lessonCompleted = lessonCompleted;
|
||||
this.feedback = escapeJson(feedback);
|
||||
this.output = escapeJson(output);
|
||||
this.assignment = assignment;
|
||||
this.attemptWasMade = attemptWasMade;
|
||||
}
|
||||
|
||||
public static AttackResultBuilder builder(PluginMessages messages) {
|
||||
return new AttackResultBuilder(messages);
|
||||
}
|
||||
|
||||
public boolean assignmentSolved() {
|
||||
return lessonCompleted;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,74 @@
|
||||
/*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2019 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software projects.
|
||||
*/
|
||||
|
||||
package org.owasp.webgoat.container.assignments;
|
||||
|
||||
import org.owasp.webgoat.container.session.WebSession;
|
||||
import org.owasp.webgoat.container.users.UserTracker;
|
||||
import org.owasp.webgoat.container.users.UserTrackerRepository;
|
||||
import org.springframework.core.MethodParameter;
|
||||
import org.springframework.http.MediaType;
|
||||
import org.springframework.http.converter.HttpMessageConverter;
|
||||
import org.springframework.http.server.ServerHttpRequest;
|
||||
import org.springframework.http.server.ServerHttpResponse;
|
||||
import org.springframework.web.bind.annotation.RestControllerAdvice;
|
||||
import org.springframework.web.servlet.mvc.method.annotation.ResponseBodyAdvice;
|
||||
|
||||
@RestControllerAdvice
|
||||
public class LessonTrackerInterceptor implements ResponseBodyAdvice<Object> {
|
||||
|
||||
private UserTrackerRepository userTrackerRepository;
|
||||
private WebSession webSession;
|
||||
|
||||
public LessonTrackerInterceptor(UserTrackerRepository userTrackerRepository, WebSession webSession) {
|
||||
this.userTrackerRepository = userTrackerRepository;
|
||||
this.webSession = webSession;
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean supports(MethodParameter methodParameter, Class<? extends HttpMessageConverter<?>> clazz) {
|
||||
return true;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Object beforeBodyWrite(Object o, MethodParameter methodParameter, MediaType mediaType, Class<? extends HttpMessageConverter<?>> aClass, ServerHttpRequest serverHttpRequest, ServerHttpResponse serverHttpResponse) {
|
||||
if (o instanceof AttackResult attackResult) {
|
||||
trackProgress(attackResult);
|
||||
}
|
||||
return o;
|
||||
}
|
||||
|
||||
|
||||
protected AttackResult trackProgress(AttackResult attackResult) {
|
||||
UserTracker userTracker = userTrackerRepository.findByUser(webSession.getUserName());
|
||||
if (userTracker == null) {
|
||||
userTracker = new UserTracker(webSession.getUserName());
|
||||
}
|
||||
if (attackResult.assignmentSolved()) {
|
||||
userTracker.assignmentSolved(webSession.getCurrentLesson(), attackResult.getAssignment());
|
||||
} else {
|
||||
userTracker.assignmentFailed(webSession.getCurrentLesson());
|
||||
}
|
||||
userTrackerRepository.saveAndFlush(userTracker);
|
||||
return attackResult;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user