Refactoring (#1201)

* Some initial refactoring

* Make it one application

* Got it working

* Fix problem on Windows

* Move WebWolf

* Move first lesson

* Moved all lessons

* Fix pom.xml

* Fix tests

* Add option to initialize a lesson

This way we can create content for each user inside a lesson. The initialize method will be called when a new user is created or when a lesson reset happens

* Clean up pom.xml files

* Remove fetching labels based on language.

We only support English at the moment, all the lesson explanations are written in English which makes it very difficult to translate. If we only had labels it would make sense to support multiple languages

* Fix SonarLint issues

* And move it all to the main project

* Fix for documentation paths

* Fix pom warnings

* Remove PMD as it does not work

* Update release notes about refactoring

Update release notes about refactoring

Update release notes about refactoring

* Fix lesson template

* Update release notes

* Keep it in the same repo in Dockerhub

* Update documentation to show how the connection is obtained.

Resolves: #1180

* Rename all integration tests

* Remove command from Dockerfile

* Simplify GitHub actions

Currently, we use a separate actions for pull-requests and branch build.
This is now consolidated in one action.
The PR action triggers always, it now only trigger when the PR is
opened and not in draft.
Running all platforms on a branch build is a bit too much, it is better
 to only run all platforms when someone opens a PR.

* Remove duplicate entry from release notes

* Add explicit registry for base image

* Lesson scanner not working when fat jar

When running the fat jar we have to take into account we
are reading from the jar file and not the filesystem. In
this case you cannot use `getFile` for example.

* added info in README and fixed release docker

* changed base image and added ignore file

Co-authored-by: Zubcevic.com <rene@zubcevic.com>

src/main/java/org/owasp/webgoat/container/lessons/Assignment.java

@@ -0,0 +1,69 @@
+package org.owasp.webgoat.container.lessons;
+
+import lombok.*;
+
+import javax.persistence.*;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * ************************************************************************************************
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * <p>
+ * Copyright (c) 2002 - 2014 Bruce Mayhew
+ * <p>
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * <p>
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * <p>
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * <p>
+ * Getting Source ==============
+ * <p>
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ * <p>
+ *
+ * @author nbaars
+ * @version $Id: $Id
+ * @since November 25, 2016
+ */
+@Getter
+@EqualsAndHashCode
+@Entity
+public class Assignment {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.AUTO)
+    private Long id;
+    private String name;
+    private String path;
+
+    @Transient
+    private List<String> hints;
+
+    private Assignment() {
+        //Hibernate
+    }
+
+    public Assignment(String name) {
+        this(name, name, new ArrayList<>());
+    }
+
+    public Assignment(String name, String path, List<String> hints) {
+        if (path.equals("") || path.equals("/") || path.equals("/WebGoat/")) {
+            throw new IllegalStateException("The path of assignment '" + name + "' overrides WebGoat endpoints, please choose a path within the scope of the lesson");
+        }
+        this.name = name;
+        this.path = path;
+        this.hints = hints;
+    }
+
+}

src/main/java/org/owasp/webgoat/container/lessons/Category.java

@@ -0,0 +1,91 @@
+package org.owasp.webgoat.container.lessons;
+
+import lombok.Getter;
+
+/**
+ * *************************************************************************************************
+ * <p>
+ * <p>
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ * <p>
+ * Copyright (c) 2002 - 2014 Bruce Mayhew
+ * <p>
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ * <p>
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ * <p>
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ * <p>
+ * Getting Source ==============
+ * <p>
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
+ * for free software projects.
+ *
+ * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
+ * @version $Id: $Id
+ * @since October 28, 2003
+ */
+public enum Category {
+
+    INTRODUCTION("Introduction", 5),
+    GENERAL("General", 100),
+    
+    INJECTION("(A1) Injection", 300),
+    AUTHENTICATION("(A2) Broken Authentication", 302),
+    INSECURE_COMMUNICATION("(A3) Sensitive Data Exposure", 303),
+    XXE("(A4) XML External Entities (XXE)", 304),
+    ACCESS_CONTROL("(A5) Broken Access Control", 305),
+    
+    XSS("(A7) Cross-Site Scripting (XSS)", 307),
+    INSECURE_DESERIALIZATION("(A8) Insecure Deserialization", 308),
+    VULNERABLE_COMPONENTS("(A9) Vulnerable Components", 309),
+    SESSION_MANAGEMENT("(A10) Session Management Flaws", 310),
+    
+    REQUEST_FORGERIES("(A8:2013) Request Forgeries", 318),
+
+    
+    REQ_FORGERIES("Request Forgeries", 450),
+    
+    INSECURE_CONFIGURATION("Insecure Configuration", 600),
+    INSECURE_STORAGE("Insecure Storage", 800),
+    
+    
+    AJAX_SECURITY("AJAX Security", 1000),
+    BUFFER_OVERFLOW("Buffer Overflows", 1100),
+    CODE_QUALITY("Code Quality", 1200),
+    CONCURRENCY("Concurrency", 1300),
+    ERROR_HANDLING("Improper Error Handling", 1400),
+    DOS("Denial of Service", 1500),
+    MALICIOUS_EXECUTION("Malicious Execution", 1600),
+    CLIENT_SIDE("Client side", 1700),
+    WEB_SERVICES("Web Services", 1900),
+    ADMIN_FUNCTIONS("Admin Functions", 2000),
+    CHALLENGE("Challenges", 3000);
+
+    @Getter
+    private String name;
+    @Getter
+    private Integer ranking;
+
+    Category(String name, Integer ranking) {
+        this.name = name;
+        this.ranking = ranking;
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public String toString() {
+        return getName();
+    }
+}

src/main/java/org/owasp/webgoat/container/lessons/CourseConfiguration.java

@@ -0,0 +1,126 @@
+/*
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 2019 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software projects.
+ */
+
+package org.owasp.webgoat.container.lessons;
+
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.ArrayUtils;
+import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
+import org.owasp.webgoat.container.assignments.AssignmentHints;
+import org.owasp.webgoat.container.assignments.AttackResult;
+import org.owasp.webgoat.container.session.Course;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.util.CollectionUtils;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+import java.lang.reflect.Method;
+import java.lang.reflect.ParameterizedType;
+import java.util.*;
+
+import static java.util.stream.Collectors.groupingBy;
+import static java.util.stream.Collectors.toList;
+
+@Slf4j
+@Configuration
+public class CourseConfiguration {
+
+    private final List<Lesson> lessons;
+    private final List<AssignmentEndpoint> assignments;
+    private final Map<String, List<AssignmentEndpoint>> assignmentsByPackage;
+
+    public CourseConfiguration(List<Lesson> lessons, List<AssignmentEndpoint> assignments) {
+        this.lessons = lessons;
+        this.assignments = assignments;
+        assignmentsByPackage = this.assignments.stream().collect(groupingBy(a -> a.getClass().getPackageName()));
+    }
+
+    @Bean
+    public Course course() {
+        lessons.stream().forEach(l -> l.setAssignments(createAssignment(l)));
+        return new Course(lessons);
+    }
+
+    private List<Assignment> createAssignment(Lesson lesson) {
+        var endpoints = assignmentsByPackage.get(lesson.getClass().getPackageName());
+        if (CollectionUtils.isEmpty(endpoints)) {
+            log.warn("Lesson: {} has no endpoints, is this intentionally?", lesson.getTitle());
+            return new ArrayList<>();
+        }
+        return endpoints.stream()
+                .map(e -> new Assignment(e.getClass().getSimpleName(), getPath(e.getClass()), getHints(e.getClass())))
+                .toList();
+    }
+
+    private String getPath(Class<? extends AssignmentEndpoint> e) {
+        for (Method m : e.getMethods()) {
+            if (methodReturnTypeIsOfTypeAttackResult(m)) {
+                var mapping = getMapping(m);
+                if (mapping != null) {
+                    return mapping;
+                }
+            }
+        }
+        throw new IllegalStateException("Assignment endpoint: " + e + " has no mapping like @GetMapping/@PostMapping etc," +
+                "with return type 'AttackResult' or 'ResponseEntity<AttackResult>' please consider adding one");
+    }
+
+    private boolean methodReturnTypeIsOfTypeAttackResult(Method m) {
+        if (m.getReturnType() == AttackResult.class) {
+            return true;
+        }
+        var genericType = m.getGenericReturnType();
+        if (genericType instanceof ParameterizedType) {
+            return ((ParameterizedType) m.getGenericReturnType()).getActualTypeArguments()[0] == AttackResult.class;
+        }
+        return false;
+    }
+
+    private String getMapping(Method m) {
+        String[] paths = null;
+        //Find the path, either it is @GetMapping("/attack") of GetMapping(path = "/attack") both are valid, we need to consider both
+        if (m.getAnnotation(RequestMapping.class) != null) {
+            paths = ArrayUtils.addAll(m.getAnnotation(RequestMapping.class).value(), m.getAnnotation(RequestMapping.class).path());
+        } else if (m.getAnnotation(PostMapping.class) != null) {
+            paths = ArrayUtils.addAll(m.getAnnotation(PostMapping.class).value(), m.getAnnotation(PostMapping.class).path());
+        } else if (m.getAnnotation(GetMapping.class) != null) {
+            paths = ArrayUtils.addAll(m.getAnnotation(GetMapping.class).value(), m.getAnnotation(GetMapping.class).path());
+        } else if (m.getAnnotation(PutMapping.class) != null) {
+            paths = ArrayUtils.addAll(m.getAnnotation(PutMapping.class).value(), m.getAnnotation(PutMapping.class).path());
+        }
+        if (paths == null) {
+            return null;
+        } else {
+            return Arrays.stream(paths).filter(path -> !"".equals(path)).findFirst().orElse("");
+        }
+    }
+
+    private List<String> getHints(Class<? extends AssignmentEndpoint> e) {
+        if (e.isAnnotationPresent(AssignmentHints.class)) {
+            return List.of(e.getAnnotationsByType(AssignmentHints.class)[0].value());
+        }
+        return Collections.emptyList();
+    }
+}

src/main/java/org/owasp/webgoat/container/lessons/Hint.java

@@ -0,0 +1,43 @@
+/***************************************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2014 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ * 
+ */
+
+package org.owasp.webgoat.container.lessons;
+
+import lombok.Value;
+
+/**
+ * <p>Hint class.</p>
+ *
+ * @author rlawson
+ * @version $Id: $Id
+ */
+@Value
+public class Hint {
+
+    private String hint;
+    private String assignmentPath;
+}

src/main/java/org/owasp/webgoat/container/lessons/Initializeable.java

@@ -0,0 +1,12 @@
+package org.owasp.webgoat.container.lessons;
+
+import org.owasp.webgoat.container.users.WebGoatUser;
+
+/**
+ * Interface for initialization of a lesson. It is called when a new user is added to WebGoat and when a users
+ * reset a lesson. Make sure to clean beforehand and then re-initialize the lesson.
+ */
+public interface Initializeable {
+
+    void initialize(WebGoatUser webGoatUser);
+}

src/main/java/org/owasp/webgoat/container/lessons/Lesson.java

@@ -0,0 +1,136 @@
+/*
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 2019 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software projects.
+ */
+
+package org.owasp.webgoat.container.lessons;
+
+import lombok.Getter;
+import lombok.Setter;
+
+import java.util.List;
+
+@Getter
+@Setter
+public abstract class Lesson {
+
+    private static int count = 1;
+    private Integer id = null;
+    private List<Assignment> assignments;
+
+    /**
+     * Constructor for the Lesson object
+     */
+    protected Lesson() {
+        id = ++count;
+    }
+
+
+    /**
+     * <p>getName.</p>
+     *
+     * @return a {@link java.lang.String} object.
+     */
+    public String getName() {
+        String className = getClass().getName();
+        return className.substring(className.lastIndexOf('.') + 1);
+    }
+
+    /**
+     * Gets the category attribute of the Lesson object
+     *
+     * @return The category value
+     */
+    public Category getCategory() {
+        return getDefaultCategory();
+    }
+
+    /**
+     * <p>getDefaultCategory.</p>
+     *
+     * @return a {@link org.owasp.webgoat.container.lessons.Category} object.
+     */
+    protected abstract Category getDefaultCategory();
+
+    /**
+     * Gets the title attribute of the HelloScreen object
+     *
+     * @return The title value
+     */
+    public abstract String getTitle();
+
+    /**
+     * <p>Returns the default "path" portion of a lesson's URL.</p>
+     * <p>
+     * <p>
+     * Legacy webgoat lesson links are of the form
+     * "attack?Screen=Xmenu=Ystage=Z". This method returns the path portion of
+     * the url, i.e., "attack" in the string above.
+     * <p>
+     * Newer, Spring-Controller-based classes will override this method to
+     * return "*.do"-styled paths.
+     *
+     * @return a {@link java.lang.String} object.
+     */
+    protected String getPath() {
+        return "#lesson/";
+    }
+
+    /**
+     * Get the link that can be used to request this screen.
+     * <p>
+     * Rendering the link in the browser may result in Javascript sending
+     * additional requests to perform necessary actions or to obtain data
+     * relevant to the lesson or the element of the lesson selected by the
+     * user.  Thanks to using the hash mark "#" and Javascript handling the
+     * clicks, the user will experience less waiting as the pages do not have
+     * to reload entirely.
+     *
+     * @return a {@link java.lang.String} object.
+     */
+    public String getLink() {
+        return String.format("%s%s.lesson", getPath(), getId());
+    }
+
+    /**
+     * Description of the Method
+     *
+     * @return Description of the Return Value
+     */
+    public String toString() {
+        return getTitle();
+    }
+
+    public final String getId() {
+        return this.getClass().getSimpleName();
+    }
+
+    public final String getPackage() {
+        var packageName = this.getClass().getPackageName();
+        //package name is the direct package name below lessons (any subpackage will be removed)
+        return packageName.replaceAll("org.owasp.webgoat.lessons.", "").replaceAll("\\..*", "");
+
+
+
+    }
+
+
+
+}

src/main/java/org/owasp/webgoat/container/lessons/LessonConnectionInvocationHandler.java

@@ -0,0 +1,39 @@
+package org.owasp.webgoat.container.lessons;
+
+import lombok.extern.slf4j.Slf4j;
+import org.owasp.webgoat.container.users.WebGoatUser;
+import org.springframework.security.core.context.SecurityContextHolder;
+
+import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.sql.Connection;
+
+/**
+ * Handler which sets the correct schema for the currently bounded user. This way users are not seeing each other
+ * data and we can reset data for just one particular user.
+ */
+@Slf4j
+public class LessonConnectionInvocationHandler implements InvocationHandler {
+
+    private final Connection targetConnection;
+
+    public LessonConnectionInvocationHandler(Connection targetConnection) {
+        this.targetConnection = targetConnection;
+    }
+
+    @Override
+    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
+        var authentication = SecurityContextHolder.getContext().getAuthentication();
+        if (authentication != null && authentication.getPrincipal() instanceof WebGoatUser user) {
+            try (var statement = targetConnection.createStatement()) {
+                statement.execute("SET SCHEMA \"" + user.getUsername() + "\"");
+            }
+        }
+        try {
+            return method.invoke(targetConnection, args);
+        } catch (InvocationTargetException e) {
+            throw e.getTargetException();
+        }
+    }
+}

src/main/java/org/owasp/webgoat/container/lessons/LessonInfoModel.java

@@ -0,0 +1,21 @@
+package org.owasp.webgoat.container.lessons;
+
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+
+/**
+ * <p>LessonInfoModel class.</p>
+ *
+ * @author dm
+ * @version $Id: $Id
+ */
+@Getter
+@AllArgsConstructor
+public class LessonInfoModel {
+
+    private String lessonTitle;
+    private boolean hasSource;
+    private boolean hasSolution;
+    private boolean hasPlan;
+
+}

src/main/java/org/owasp/webgoat/container/lessons/LessonMenuItem.java

@@ -0,0 +1,166 @@
+/**
+ * *************************************************************************************************
+ * <p>
+ * <p>
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ * <p>
+ * Copyright (c) 2002 - 2014 Bruce Mayhew
+ * <p>
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ * <p>
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ * <p>
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ * <p>
+ * Getting Source ==============
+ * <p>
+ * Source for this application is maintained at
+ * https://github.com/WebGoat/WebGoat, a repository for free software projects.
+ */
+
+package org.owasp.webgoat.container.lessons;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * <p>LessonMenuItem class.</p>
+ *
+ * @author rlawson
+ * @version $Id: $Id
+ */
+public class LessonMenuItem {
+
+    private String name;
+    private LessonMenuItemType type;
+    private List<LessonMenuItem> children = new ArrayList<>();
+    private boolean complete;
+    private String link;
+    private int ranking;
+
+    /**
+     * <p>Getter for the field <code>name</code>.</p>
+     *
+     * @return the name
+     */
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * <p>Setter for the field <code>name</code>.</p>
+     *
+     * @param name the name to set
+     */
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    /**
+     * <p>Getter for the field <code>children</code>.</p>
+     *
+     * @return the children
+     */
+    public List<LessonMenuItem> getChildren() {
+        return children;
+    }
+
+    /**
+     * <p>Setter for the field <code>children</code>.</p>
+     *
+     * @param children the children to set
+     */
+    public void setChildren(List<LessonMenuItem> children) {
+        this.children = children;
+    }
+
+    /**
+     * <p>Getter for the field <code>type</code>.</p>
+     *
+     * @return the type
+     */
+    public LessonMenuItemType getType() {
+        return type;
+    }
+
+    /**
+     * <p>Setter for the field <code>type</code>.</p>
+     *
+     * @param type the type to set
+     */
+    public void setType(LessonMenuItemType type) {
+        this.type = type;
+    }
+
+    /**
+     * <p>addChild.</p>
+     *
+     * @param child a {@link LessonMenuItem} object.
+     */
+    public void addChild(LessonMenuItem child) {
+        children.add(child);
+    }
+
+    @Override
+    public String toString() {
+        StringBuilder bldr = new StringBuilder();
+        bldr.append("Name: ").append(name).append(" | ");
+        bldr.append("Type: ").append(type).append(" | ");
+        return bldr.toString();
+    }
+
+    /**
+     * <p>isComplete.</p>
+     *
+     * @return the complete
+     */
+    public boolean isComplete() {
+        return complete;
+    }
+
+    /**
+     * <p>Setter for the field <code>complete</code>.</p>
+     *
+     * @param complete the complete to set
+     */
+    public void setComplete(boolean complete) {
+        this.complete = complete;
+    }
+
+    /**
+     * <p>Getter for the field <code>link</code>.</p>
+     *
+     * @return the link
+     */
+    public String getLink() {
+        return link;
+    }
+
+    /**
+     * <p>Setter for the field <code>link</code>.</p>
+     *
+     * @param link the link to set
+     */
+    public void setLink(String link) {
+        this.link = link;
+    }
+
+    public void setRanking(int ranking) {
+        this.ranking = ranking;
+    }
+
+    public int getRanking() {
+        return this.ranking;
+    }
+
+
+}

src/main/java/org/owasp/webgoat/container/lessons/LessonMenuItemType.java

@@ -0,0 +1,40 @@
+/***************************************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2014 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ * 
+ */
+
+package org.owasp.webgoat.container.lessons;
+
+/**
+ * <p>LessonMenuItemType class.</p>
+ *
+ * @author rlawson
+ * @version $Id: $Id
+ */
+public enum LessonMenuItemType {
+    CATEGORY,
+    LESSON,
+    STAGE
+}

src/main/java/org/owasp/webgoat/container/lessons/LessonScanner.java

@@ -0,0 +1,46 @@
+package org.owasp.webgoat.container.lessons;
+
+import lombok.Getter;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.support.ResourcePatternResolver;
+import org.springframework.stereotype.Component;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.regex.Pattern;
+
+@Component
+@Slf4j
+public class LessonScanner {
+
+    private static final Pattern lessonPattern = Pattern.compile("^.*/lessons/([^/]*)/.*$");
+
+    @Getter
+    private final Set<String> lessons = new HashSet<>();
+
+    public LessonScanner(ResourcePatternResolver resourcePatternResolver) {
+        try {
+            var resources = resourcePatternResolver.getResources("classpath:/lessons/*/*");
+            for (var resource : resources) {
+                //WG can run as a fat jar or as directly from file system we need to support both so use the URL
+                var url = resource.getURL();
+                var matcher = lessonPattern.matcher(url.toString());
+                if (matcher.matches()) {
+                    lessons.add(matcher.group(1));
+                }
+            }
+            log.debug("Found {} lessons", lessons.size());
+        } catch (IOException e) {
+            log.warn("No lessons found...");
+        }
+
+    }
+
+    public List<String> applyPattern(String pattern) {
+        return lessons.stream().map(lesson -> String.format(pattern, lesson)).toList();
+    }
+}