Refactoring (#1201)

* Some initial refactoring

* Make it one application

* Got it working

* Fix problem on Windows

* Move WebWolf

* Move first lesson

* Moved all lessons

* Fix pom.xml

* Fix tests

* Add option to initialize a lesson

This way we can create content for each user inside a lesson. The initialize method will be called when a new user is created or when a lesson reset happens

* Clean up pom.xml files

* Remove fetching labels based on language.

We only support English at the moment, all the lesson explanations are written in English which makes it very difficult to translate. If we only had labels it would make sense to support multiple languages

* Fix SonarLint issues

* And move it all to the main project

* Fix for documentation paths

* Fix pom warnings

* Remove PMD as it does not work

* Update release notes about refactoring

Update release notes about refactoring

Update release notes about refactoring

* Fix lesson template

* Update release notes

* Keep it in the same repo in Dockerhub

* Update documentation to show how the connection is obtained.

Resolves: #1180

* Rename all integration tests

* Remove command from Dockerfile

* Simplify GitHub actions

Currently, we use a separate actions for pull-requests and branch build.
This is now consolidated in one action.
The PR action triggers always, it now only trigger when the PR is
opened and not in draft.
Running all platforms on a branch build is a bit too much, it is better
 to only run all platforms when someone opens a PR.

* Remove duplicate entry from release notes

* Add explicit registry for base image

* Lesson scanner not working when fat jar

When running the fat jar we have to take into account we
are reading from the jar file and not the filesystem. In
this case you cannot use `getFile` for example.

* added info in README and fixed release docker

* changed base image and added ignore file

Co-authored-by: Zubcevic.com <rene@zubcevic.com>

src/main/resources/lessons/xss/i18n/WebGoatLabels.properties

@@ -0,0 +1,42 @@
+# XSS success, failure messages and hints
+xss.title=Cross Site Scripting
+xss-stored.title=Cross Site Scripting (stored)
+xss-mitigation.title=Cross Site Scripting (mitigation)
+xss-reflected-5a-success-alert=Congratulations, but alerts are not very impressive are they? Let's continue to the next assignment.
+xss-reflected-5a-success-console=Congratulations, but console logs are not very impressive are they? Let's continue to the next assignment.
+xss-reflected-5a-failed-wrong-field=Seems like you tried to compromise our shop with an reflected XSS attack.<br/> We do our... "best"... to prevent such attacks. Try again!
+xss-reflected-5a-failure=Try again. We do want to see a specific JavaScript mentioned in the goal of the assignment (in case you are trying to do something fancier).
+xss-reflected-5a-hint-1=Think about how the inputs are presumably processed by the application.
+xss-reflected-5a-hint-2=Quantity inputs are probably processed as integer values. Not the best option for inputting text right?
+xss-reflected-5a-hint-3=What information send to the application gets reflected back after being submitted?
+xss-reflected-5a-hint-4=Just try purchasing something. You want your script to be included in the purchase-confirmation.
+xss-reflected-5b-success=Correct ... because <ul><li>The script was not triggered by the URL/QueryString</li><li>Even if you use the attack URL in a new tab, it will not execute (because of response type). Try it if you like.</li></ul>
+xss-reflected-6a-success=Correct! Now, see if you can send in an exploit to that route in the next assignment.
+xss-reflected-6a-failure=Sorry that is not correct. Look at the example again to understand what a valid route looks like. If you're stuck... hints might help.
+xss-reflected-6a-hint-1=To search through the client side code, use the developer tools of your browser. (If you don't know how to use them, check the <i>Developer Tools</i> Lesson in the general category.)
+xss-reflected-6a-hint-2=Since you are looking for application code, check the WebGoat/js/goatApp folder for a file that could handle the routes.
+xss-reflected-6a-hint-3=Make sure you add the base route at the start, when submitting your solution.
+xss-reflected-6a-hint-4=Still did not find it? Check the <a href="/WebGoat/js/goatApp/view/GoatRouter.js" target="_blank">GoatRouter.js</a> file. It should be pretty easy to determine.
+xss.lesson1.failure=The cookies should be the same on both tabs. Ensure that the tabs are from the same site.
+xss-dom-message-success=Correct, I hope you did not cheat, using the console!
+xss-dom-message-failure=Incorrect, keep trying. It should be obvious in the log when you are successful.
+xss-dom-message-hint-1=Open a new tab and navigate to the test-route you just figured out in the previous lesson.
+xss-dom-message-hint-2=Your url should look something like that http://localhost:8080/WebGoat/start.mvc#REPLACE-WITH-THE-TEST-ROUTE/some_parameters
+xss-dom-message-hint-3=Note how the parameters you send to the test-route get reflected back to the page. Now add your JavaScript to it.
+xss-dom-message-hint-4=You have to use script tags, so your JavaScript code gets executed when being rendered into the DOM.
+xss-dom-message-hint-5=Since you are working with an URL, you might have to URL-encode your parameters.
+xss-dom-message-hint-6=Replace '/' with '%2F' in your URL parameters.
+xss-stored-comment-success=It appears your payload should invoke the function. To tell for sure, you need to capture the value and put it in the form below. Then we will really know.
+xss-stored-comment-failure=We cannot see the payload in your submission, but XSS can be tricky. Look for the call back fired after the comments reload. If you see that and can put the correct value there and put it in, maybe you did succeed.
+xss-stored-callback-success=Yes, that is the correct value (note, it will be a different value each time the phoneHome endpoint is called).
+xss-stored-callback-failure=No, that is not the correct value (note, it will be a different value each time the phoneHome endpoint is called).
+xss-mitigation-3-hint1=You do not store the user input in this example. Try to encode the user's input right before you place it into the HTML document.
+xss-mitigation-3-hint2=Make use of JavaServer Pages Standard Tag Library (JSTL) and JSP Expression Language.
+xss-mitigation-3-hint3=Take a look at OWASP Java Encoder Project.
+xss-mitigation-3-hint4=Do not forget to reference the tag libs and choose "e" as prefix.
+xss-mitigation-3-success=You have completed this lesson. Congratulations!
+xss-mitigation-3-failure=This in not the correct answer. Try again!
+xss-mitigation-3-no-code=You did not change anything.
+xss-mitigation-4-hint1=Try to have a look at the AntiSamy documentation.
+xss-mitigation-4-success=You have completed this lesson. Congratulations!
+xss-mitigation-4-failed=This is not the correct answer. Try again!