git-svn-id: http://webgoat.googlecode.com/svn/trunk@6 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
mayhew64
@ -0,0 +1,137 @@
|
||||
package org.owasp.webgoat.lessons.RoleBasedAccessControl;
|
||||
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.sql.Statement;
|
||||
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.lessons.DefaultLessonAction;
|
||||
import org.owasp.webgoat.lessons.LessonAction;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
public class DeleteProfile extends DefaultLessonAction
|
||||
{
|
||||
private LessonAction chainedAction;
|
||||
|
||||
public DeleteProfile(AbstractLesson lesson, String lessonName, String actionName, LessonAction chainedAction)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
this.chainedAction = chainedAction;
|
||||
}
|
||||
|
||||
public void handleRequest( WebSession s )
|
||||
throws ParameterNotFoundException, UnauthenticatedException, UnauthorizedException, ValidationException
|
||||
{
|
||||
getLesson().setCurrentAction(s, getActionName());
|
||||
|
||||
int userId = getIntSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.USER_ID);
|
||||
int employeeId = s.getParser().getIntParameter(RoleBasedAccessControl.EMPLOYEE_ID);
|
||||
|
||||
if (isAuthenticated(s))
|
||||
{
|
||||
deleteEmployeeProfile(s, userId, employeeId);
|
||||
|
||||
try
|
||||
{
|
||||
chainedAction.handleRequest(s);
|
||||
}
|
||||
catch (UnauthenticatedException ue1)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue1.printStackTrace();
|
||||
}
|
||||
catch (UnauthorizedException ue2)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue2.printStackTrace();
|
||||
}
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
|
||||
updateLessonStatus(s);
|
||||
}
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return RoleBasedAccessControl.LISTSTAFF_ACTION;
|
||||
}
|
||||
|
||||
|
||||
public void deleteEmployeeProfile(WebSession s, int userId, int employeeId)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
try
|
||||
{
|
||||
// Note: The password field is ONLY set by ChangePassword
|
||||
String query = "DELETE FROM employee WHERE userid = " + employeeId;
|
||||
//System.out.println("Query: " + query);
|
||||
try
|
||||
{
|
||||
Statement statement = WebSession.getConnection(s).createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
statement.executeUpdate(query);
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error deleting employee profile" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error deleting employee profile" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public void deleteEmployeeProfile_BACKUP(WebSession s, int userId, int employeeId)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
try
|
||||
{
|
||||
// Note: The password field is ONLY set by ChangePassword
|
||||
String query = "DELETE FROM employee WHERE userid = " + employeeId;
|
||||
//System.out.println("Query: " + query);
|
||||
try
|
||||
{
|
||||
Statement statement = WebSession.getConnection(s).createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
statement.executeUpdate(query);
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error deleting employee profile" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error deleting employee profile" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
private void updateLessonStatus(WebSession s)
|
||||
{
|
||||
// If the logged in user is not authorized to be here, stage is complete.
|
||||
try
|
||||
{
|
||||
int userId = getIntSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.USER_ID);
|
||||
|
||||
if (!isAuthorized(s, userId, RoleBasedAccessControl.DELETEPROFILE_ACTION))
|
||||
{
|
||||
s.setMessage( "Welcome to stage 2 -- protecting the business layer" );
|
||||
setStage(s, 2);
|
||||
}
|
||||
}
|
||||
catch (ParameterNotFoundException e)
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,160 @@
|
||||
package org.owasp.webgoat.lessons.RoleBasedAccessControl;
|
||||
|
||||
import java.sql.PreparedStatement;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.lessons.DefaultLessonAction;
|
||||
import org.owasp.webgoat.session.Employee;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
public class EditProfile extends DefaultLessonAction
|
||||
{
|
||||
public EditProfile(AbstractLesson lesson, String lessonName, String actionName)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
}
|
||||
|
||||
public void handleRequest( WebSession s )
|
||||
throws ParameterNotFoundException, UnauthenticatedException, UnauthorizedException
|
||||
{
|
||||
getLesson().setCurrentAction(s, getActionName());
|
||||
|
||||
if (isAuthenticated(s))
|
||||
{
|
||||
int userId = getUserId(s);
|
||||
int employeeId = s.getParser().getIntParameter(RoleBasedAccessControl.EMPLOYEE_ID);
|
||||
|
||||
Employee employee = getEmployeeProfile(s, userId, employeeId);
|
||||
setSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.EMPLOYEE_ATTRIBUTE_KEY, employee);
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
}
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return RoleBasedAccessControl.EDITPROFILE_ACTION;
|
||||
}
|
||||
|
||||
|
||||
public Employee getEmployeeProfile(WebSession s, int userId, int subjectUserId)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
Employee profile = null;
|
||||
|
||||
// Query the database for the profile data of the given employee
|
||||
try
|
||||
{
|
||||
String query = "SELECT * FROM employee WHERE userid = ?";
|
||||
|
||||
try
|
||||
{
|
||||
PreparedStatement answer_statement = WebSession.getConnection(s).prepareStatement( query,
|
||||
ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
answer_statement.setInt(1, subjectUserId);
|
||||
ResultSet answer_results = answer_statement.executeQuery();
|
||||
if (answer_results.next())
|
||||
{
|
||||
// Note: Do NOT get the password field.
|
||||
profile = new Employee(
|
||||
answer_results.getInt("userid"),
|
||||
answer_results.getString("first_name"),
|
||||
answer_results.getString("last_name"),
|
||||
answer_results.getString("ssn"),
|
||||
answer_results.getString("title"),
|
||||
answer_results.getString("phone"),
|
||||
answer_results.getString("address1"),
|
||||
answer_results.getString("address2"),
|
||||
answer_results.getInt("manager"),
|
||||
answer_results.getString("start_date"),
|
||||
answer_results.getInt("salary"),
|
||||
answer_results.getString("ccn"),
|
||||
answer_results.getInt("ccn_limit"),
|
||||
answer_results.getString("disciplined_date"),
|
||||
answer_results.getString("disciplined_notes"),
|
||||
answer_results.getString("personal_description"));
|
||||
/* System.out.println("Retrieved employee from db: " +
|
||||
profile.getFirstName() + " " + profile.getLastName() +
|
||||
" (" + profile.getId() + ")");
|
||||
*/ }
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error getting employee profile" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error getting employee profile" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return profile;
|
||||
}
|
||||
|
||||
public Employee getEmployeeProfile_BACKUP(WebSession s, int userId, int subjectUserId)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
// Query the database to determine if this employee has access to this function
|
||||
// Query the database for the profile data of the given employee if "owned" by the given user
|
||||
|
||||
Employee profile = null;
|
||||
|
||||
// Query the database for the profile data of the given employee
|
||||
try
|
||||
{
|
||||
String query = "SELECT * FROM employee WHERE userid = ?";
|
||||
|
||||
try
|
||||
{
|
||||
PreparedStatement answer_statement = WebSession.getConnection(s).prepareStatement( query,
|
||||
ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
answer_statement.setInt(1, subjectUserId);
|
||||
ResultSet answer_results = answer_statement.executeQuery();
|
||||
if (answer_results.next())
|
||||
{
|
||||
// Note: Do NOT get the password field.
|
||||
profile = new Employee(
|
||||
answer_results.getInt("userid"),
|
||||
answer_results.getString("first_name"),
|
||||
answer_results.getString("last_name"),
|
||||
answer_results.getString("ssn"),
|
||||
answer_results.getString("title"),
|
||||
answer_results.getString("phone"),
|
||||
answer_results.getString("address1"),
|
||||
answer_results.getString("address2"),
|
||||
answer_results.getInt("manager"),
|
||||
answer_results.getString("start_date"),
|
||||
answer_results.getInt("salary"),
|
||||
answer_results.getString("ccn"),
|
||||
answer_results.getInt("ccn_limit"),
|
||||
answer_results.getString("disciplined_date"),
|
||||
answer_results.getString("disciplined_notes"),
|
||||
answer_results.getString("personal_description"));
|
||||
/* System.out.println("Retrieved employee from db: " +
|
||||
profile.getFirstName() + " " + profile.getLastName() +
|
||||
" (" + profile.getId() + ")");
|
||||
*/ }
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error getting employee profile" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error getting employee profile" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return profile;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,151 @@
|
||||
package org.owasp.webgoat.lessons.RoleBasedAccessControl;
|
||||
|
||||
import java.sql.PreparedStatement;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.lessons.DefaultLessonAction;
|
||||
import org.owasp.webgoat.lessons.LessonAction;
|
||||
import org.owasp.webgoat.session.Employee;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
public class FindProfile extends DefaultLessonAction
|
||||
{
|
||||
private LessonAction chainedAction;
|
||||
|
||||
public FindProfile(AbstractLesson lesson, String lessonName, String actionName, LessonAction chainedAction)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
this.chainedAction = chainedAction;
|
||||
}
|
||||
|
||||
public void handleRequest( WebSession s )
|
||||
throws ParameterNotFoundException, UnauthenticatedException, UnauthorizedException, ValidationException
|
||||
{
|
||||
if (isAuthenticated(s))
|
||||
{
|
||||
int userId = getIntSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.USER_ID);
|
||||
|
||||
String pattern = s.getParser().getRawParameter(RoleBasedAccessControl.SEARCHNAME);
|
||||
|
||||
findEmployeeProfile(s, userId, pattern);
|
||||
|
||||
// Execute the chained Action if the employee was found.
|
||||
if (foundEmployee(s))
|
||||
{
|
||||
try
|
||||
{
|
||||
chainedAction.handleRequest(s);
|
||||
}
|
||||
catch (UnauthenticatedException ue1)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue1.printStackTrace();
|
||||
}
|
||||
catch (UnauthorizedException ue2)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue2.printStackTrace();
|
||||
}
|
||||
}
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
}
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
String page = RoleBasedAccessControl.SEARCHSTAFF_ACTION;
|
||||
|
||||
if (foundEmployee(s))
|
||||
page = RoleBasedAccessControl.VIEWPROFILE_ACTION;
|
||||
|
||||
return page;
|
||||
}
|
||||
|
||||
private boolean foundEmployee(WebSession s)
|
||||
{
|
||||
boolean found = false;
|
||||
try
|
||||
{
|
||||
int id = getIntRequestAttribute(s, getLessonName() + "." + RoleBasedAccessControl.EMPLOYEE_ID);
|
||||
found = true;
|
||||
}
|
||||
catch (ParameterNotFoundException e)
|
||||
{
|
||||
}
|
||||
|
||||
return found;
|
||||
}
|
||||
|
||||
public Employee findEmployeeProfile(WebSession s, int userId, String pattern)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
Employee profile = null;
|
||||
// Clear any residual employee id's in the session now.
|
||||
removeSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.EMPLOYEE_ID);
|
||||
|
||||
// Query the database for the profile data of the given employee
|
||||
try
|
||||
{
|
||||
String query = "SELECT * FROM employee WHERE first_name like ? OR last_name = ?";
|
||||
|
||||
try
|
||||
{
|
||||
PreparedStatement answer_statement = WebSession.getConnection(s).prepareStatement( query,
|
||||
ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
answer_statement.setString(1, "%" + pattern + "%");
|
||||
answer_statement.setString(2, "%" + pattern + "%");
|
||||
ResultSet answer_results = answer_statement.executeQuery();
|
||||
|
||||
// Just use the first hit.
|
||||
if (answer_results.next())
|
||||
{
|
||||
int id = answer_results.getInt("userid");
|
||||
// Note: Do NOT get the password field.
|
||||
profile = new Employee(
|
||||
id,
|
||||
answer_results.getString("first_name"),
|
||||
answer_results.getString("last_name"),
|
||||
answer_results.getString("ssn"),
|
||||
answer_results.getString("title"),
|
||||
answer_results.getString("phone"),
|
||||
answer_results.getString("address1"),
|
||||
answer_results.getString("address2"),
|
||||
answer_results.getInt("manager"),
|
||||
answer_results.getString("start_date"),
|
||||
answer_results.getInt("salary"),
|
||||
answer_results.getString("ccn"),
|
||||
answer_results.getInt("ccn_limit"),
|
||||
answer_results.getString("disciplined_date"),
|
||||
answer_results.getString("disciplined_notes"),
|
||||
answer_results.getString("personal_description"));
|
||||
|
||||
/* System.out.println("Retrieved employee from db: " +
|
||||
profile.getFirstName() + " " + profile.getLastName() +
|
||||
" (" + profile.getId() + ")");
|
||||
*/
|
||||
setRequestAttribute(s, getLessonName() + "." + RoleBasedAccessControl.EMPLOYEE_ID, Integer.toString(id));
|
||||
}
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error finding employee profile" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error finding employee profile" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return profile;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,134 @@
|
||||
package org.owasp.webgoat.lessons.RoleBasedAccessControl;
|
||||
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.sql.Statement;
|
||||
import java.util.List;
|
||||
import java.util.Vector;
|
||||
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.lessons.DefaultLessonAction;
|
||||
import org.owasp.webgoat.session.EmployeeStub;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
public class ListStaff extends DefaultLessonAction
|
||||
{
|
||||
public ListStaff(AbstractLesson lesson, String lessonName, String actionName)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
}
|
||||
|
||||
public void handleRequest( WebSession s )
|
||||
throws ParameterNotFoundException, UnauthenticatedException, UnauthorizedException
|
||||
{
|
||||
getLesson().setCurrentAction(s, getActionName());
|
||||
|
||||
if (isAuthenticated(s))
|
||||
{
|
||||
int userId = getIntSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.USER_ID);
|
||||
|
||||
List employees = getAllEmployees(s, userId);
|
||||
setSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.STAFF_ATTRIBUTE_KEY, employees);
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
}
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return RoleBasedAccessControl.LISTSTAFF_ACTION;
|
||||
}
|
||||
|
||||
|
||||
public List getAllEmployees(WebSession s, int userId)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
// Query the database for all employees "owned" by the given employee
|
||||
|
||||
List employees = new Vector();
|
||||
|
||||
try
|
||||
{
|
||||
String query = "SELECT employee.userid,first_name,last_name,role FROM employee,roles WHERE employee.userid=roles.userid and employee.userid in "
|
||||
+ "(SELECT employee_id FROM ownership WHERE employer_id = " + userId + ")";
|
||||
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s).createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
ResultSet answer_results = answer_statement.executeQuery( query );
|
||||
answer_results.beforeFirst();
|
||||
while (answer_results.next())
|
||||
{
|
||||
int employeeId = answer_results.getInt("userid");
|
||||
String firstName = answer_results.getString("first_name");
|
||||
String lastName = answer_results.getString("last_name");
|
||||
String role = answer_results.getString("role");
|
||||
//System.out.println("Retrieving employee stub for role " + role);
|
||||
EmployeeStub stub = new EmployeeStub(employeeId, firstName, lastName, role);
|
||||
employees.add(stub);
|
||||
}
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error getting employees" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error getting employees" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
|
||||
return employees;
|
||||
}
|
||||
|
||||
public List getAllEmployees_BACKUP(WebSession s, int userId)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
// Query the database for all employees "owned" by the given employee
|
||||
|
||||
List employees = new Vector();
|
||||
|
||||
try
|
||||
{
|
||||
String query = "SELECT employee.userid,first_name,last_name,role FROM employee,roles WHERE employee.userid=roles.userid and employee.userid in "
|
||||
+ "(SELECT employee_id FROM ownership WHERE employer_id = " + userId + ")";
|
||||
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s).createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
ResultSet answer_results = answer_statement.executeQuery( query );
|
||||
answer_results.beforeFirst();
|
||||
while (answer_results.next())
|
||||
{
|
||||
int employeeId = answer_results.getInt("userid");
|
||||
String firstName = answer_results.getString("first_name");
|
||||
String lastName = answer_results.getString("last_name");
|
||||
String role = answer_results.getString("role");
|
||||
//System.out.println("Retrieving employee stub for role " + role);
|
||||
EmployeeStub stub = new EmployeeStub(employeeId, firstName, lastName, role);
|
||||
employees.add(stub);
|
||||
}
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error getting employees" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error getting employees" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
|
||||
return employees;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,172 @@
|
||||
package org.owasp.webgoat.lessons.RoleBasedAccessControl;
|
||||
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.sql.Statement;
|
||||
import java.util.List;
|
||||
import java.util.Vector;
|
||||
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.lessons.DefaultLessonAction;
|
||||
import org.owasp.webgoat.lessons.LessonAction;
|
||||
import org.owasp.webgoat.session.EmployeeStub;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
public class Login extends DefaultLessonAction
|
||||
{
|
||||
private LessonAction chainedAction;
|
||||
|
||||
public Login(AbstractLesson lesson, String lessonName, String actionName, LessonAction chainedAction)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
this.chainedAction = chainedAction;
|
||||
}
|
||||
|
||||
public void handleRequest( WebSession s ) throws ParameterNotFoundException, ValidationException
|
||||
{
|
||||
//System.out.println("Login.handleRequest()");
|
||||
getLesson().setCurrentAction(s, getActionName());
|
||||
|
||||
List employees = getAllEmployees(s);
|
||||
setSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.STAFF_ATTRIBUTE_KEY, employees);
|
||||
|
||||
int employeeId = -1;
|
||||
try
|
||||
{
|
||||
employeeId = s.getParser().getIntParameter(RoleBasedAccessControl.EMPLOYEE_ID);
|
||||
String password = s.getParser().getStringParameter(RoleBasedAccessControl.PASSWORD);
|
||||
|
||||
// Attempt authentication
|
||||
if (login(s, employeeId, password))
|
||||
{
|
||||
// Execute the chained Action if authentication succeeded.
|
||||
try
|
||||
{
|
||||
chainedAction.handleRequest(s);
|
||||
}
|
||||
catch (UnauthenticatedException ue1)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue1.printStackTrace();
|
||||
}
|
||||
catch (UnauthorizedException ue2)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue2.printStackTrace();
|
||||
}
|
||||
}
|
||||
else
|
||||
s.setMessage("Login failed");
|
||||
}
|
||||
catch (ParameterNotFoundException pnfe)
|
||||
{
|
||||
// No credentials offered, so we log them out
|
||||
setSessionAttribute(s, getLessonName() + ".isAuthenticated", Boolean.FALSE);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* After this.handleRequest() is called, when the View asks for the current JSP to load,
|
||||
* it will get one initialized by this call.
|
||||
*/
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
String nextPage = RoleBasedAccessControl.LOGIN_ACTION;
|
||||
|
||||
if (isAuthenticated(s))
|
||||
nextPage = chainedAction.getNextPage(s);
|
||||
|
||||
return nextPage;
|
||||
|
||||
}
|
||||
|
||||
public boolean requiresAuthentication()
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
public boolean login(WebSession s, int userId, String password)
|
||||
{
|
||||
//System.out.println("Logging in to lesson");
|
||||
boolean authenticated = false;
|
||||
|
||||
try
|
||||
{
|
||||
String query = "SELECT * FROM employee WHERE userid = " + userId + " and password = '" + password + "'";
|
||||
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s).createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
ResultSet answer_results = answer_statement.executeQuery( query );
|
||||
if (answer_results.first())
|
||||
{
|
||||
setSessionAttribute(s, getLessonName() + ".isAuthenticated", Boolean.TRUE);
|
||||
setSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.USER_ID, Integer.toString(userId));
|
||||
authenticated = true;
|
||||
}
|
||||
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error logging in" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error logging in" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
//System.out.println("Lesson login result: " + authenticated);
|
||||
return authenticated;
|
||||
}
|
||||
|
||||
public List getAllEmployees(WebSession s)
|
||||
{
|
||||
List employees = new Vector();
|
||||
|
||||
// Query the database for all roles the given employee belongs to
|
||||
// Query the database for all employees "owned" by these roles
|
||||
|
||||
try
|
||||
{
|
||||
String query = "SELECT employee.userid,first_name,last_name,role FROM employee,roles " +
|
||||
"where employee.userid=roles.userid";
|
||||
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s).createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
ResultSet answer_results = answer_statement.executeQuery( query );
|
||||
answer_results.beforeFirst();
|
||||
while (answer_results.next())
|
||||
{
|
||||
int employeeId = answer_results.getInt("userid");
|
||||
String firstName = answer_results.getString("first_name");
|
||||
String lastName = answer_results.getString("last_name");
|
||||
String role = answer_results.getString("role");
|
||||
EmployeeStub stub = new EmployeeStub(employeeId, firstName, lastName, role);
|
||||
employees.add(stub);
|
||||
}
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error getting employees" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error getting employees" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
|
||||
return employees;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,51 @@
|
||||
package org.owasp.webgoat.lessons.RoleBasedAccessControl;
|
||||
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.lessons.DefaultLessonAction;
|
||||
import org.owasp.webgoat.lessons.LessonAction;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
public class Logout extends DefaultLessonAction
|
||||
{
|
||||
private LessonAction chainedAction;
|
||||
|
||||
public Logout(AbstractLesson lesson, String lessonName, String actionName, LessonAction chainedAction)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
this.chainedAction = chainedAction;
|
||||
}
|
||||
|
||||
public void handleRequest( WebSession s ) throws ParameterNotFoundException, ValidationException
|
||||
{
|
||||
//System.out.println("Logging out");
|
||||
|
||||
setSessionAttribute(s, getLessonName() + ".isAuthenticated", Boolean.FALSE);
|
||||
|
||||
// FIXME: Maybe we should forward to Login.
|
||||
try
|
||||
{
|
||||
chainedAction.handleRequest(s);
|
||||
}
|
||||
catch (UnauthenticatedException ue1)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue1.printStackTrace();
|
||||
}
|
||||
catch (UnauthorizedException ue2)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue2.printStackTrace();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return chainedAction.getNextPage(s);
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,440 @@
|
||||
package org.owasp.webgoat.lessons.RoleBasedAccessControl;
|
||||
|
||||
import java.sql.Connection;
|
||||
import java.sql.SQLException;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Hashtable;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.lessons.Category;
|
||||
import org.owasp.webgoat.lessons.LessonAction;
|
||||
import org.owasp.webgoat.lessons.LessonAdapter;
|
||||
import org.owasp.webgoat.session.DatabaseUtilities;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
/**
|
||||
* Copyright (c) 2006 Free Software Foundation developed under the custody of the Open Web
|
||||
* Application Security Project (http://www.owasp.org) This software package org.owasp.webgoat.is published by OWASP
|
||||
* under the GPL. You should read and accept the LICENSE before you use, modify and/or redistribute
|
||||
* this software.
|
||||
*
|
||||
*/
|
||||
public class RoleBasedAccessControl extends LessonAdapter
|
||||
{
|
||||
public final static String DESCRIPTION = "description";
|
||||
public final static String DISCIPLINARY_DATE = "disciplinaryDate";
|
||||
public final static String DISCIPLINARY_NOTES = "disciplinaryNotes";
|
||||
public final static String CCN_LIMIT = "ccnLimit";
|
||||
public final static String CCN = "ccn";
|
||||
public final static String SALARY = "salary";
|
||||
public final static String START_DATE = "startDate";
|
||||
public final static String MANAGER = "manager";
|
||||
public final static String ADDRESS1 = "address1";
|
||||
public final static String ADDRESS2 = "address2";
|
||||
public final static String PHONE_NUMBER = "phoneNumber";
|
||||
public final static String TITLE = "title";
|
||||
public final static String SSN = "ssn";
|
||||
public final static String LAST_NAME = "lastName";
|
||||
public final static String FIRST_NAME = "firstName";
|
||||
public final static String PASSWORD = "password";
|
||||
|
||||
public final static String EMPLOYEE_ID = "employee_id";
|
||||
public final static String USER_ID = "user_id";
|
||||
public final static String SEARCHNAME = "search_name";
|
||||
public final static String SEARCHRESULT_ATTRIBUTE_KEY = "SearchResult";
|
||||
public final static String EMPLOYEE_ATTRIBUTE_KEY = "Employee";
|
||||
public final static String STAFF_ATTRIBUTE_KEY = "Staff";
|
||||
|
||||
public final static String LOGIN_ACTION = "Login";
|
||||
public final static String LOGOUT_ACTION = "Logout";
|
||||
public final static String LISTSTAFF_ACTION = "ListStaff";
|
||||
public final static String SEARCHSTAFF_ACTION = "SearchStaff";
|
||||
public final static String FINDPROFILE_ACTION = "FindProfile";
|
||||
public final static String VIEWPROFILE_ACTION = "ViewProfile";
|
||||
public final static String EDITPROFILE_ACTION = "EditProfile";
|
||||
public final static String UPDATEPROFILE_ACTION = "UpdateProfile";
|
||||
public final static String CREATEPROFILE_ACTION = "CreateProfile";
|
||||
public final static String DELETEPROFILE_ACTION = "DeleteProfile";
|
||||
public final static String ERROR_ACTION = "error";
|
||||
|
||||
private final static String LESSON_NAME = "RoleBasedAccessControl";
|
||||
private final static String JSP_PATH = "/lessons/" + LESSON_NAME + "/";
|
||||
|
||||
private final static Integer DEFAULT_RANKING = new Integer(120);
|
||||
|
||||
private static Connection connection = null;
|
||||
|
||||
private Map lessonFunctions = new Hashtable();
|
||||
|
||||
public static synchronized Connection getConnection(WebSession s)
|
||||
throws SQLException, ClassNotFoundException
|
||||
{
|
||||
if ( connection == null )
|
||||
{
|
||||
connection = DatabaseUtilities.makeConnection( s );
|
||||
}
|
||||
|
||||
return connection;
|
||||
}
|
||||
|
||||
public RoleBasedAccessControl()
|
||||
{
|
||||
String myClassName = parseClassName(this.getClass().getName());
|
||||
registerAction(new ListStaff(this, myClassName, LISTSTAFF_ACTION));
|
||||
registerAction(new SearchStaff(this, myClassName, SEARCHSTAFF_ACTION));
|
||||
registerAction(new ViewProfile(this, myClassName, VIEWPROFILE_ACTION));
|
||||
registerAction(new EditProfile(this, myClassName, EDITPROFILE_ACTION));
|
||||
registerAction(new EditProfile(this, myClassName, CREATEPROFILE_ACTION));
|
||||
|
||||
// These actions are special in that they chain to other actions.
|
||||
registerAction(new Login(this, myClassName, LOGIN_ACTION, getAction(LISTSTAFF_ACTION)));
|
||||
registerAction(new Logout(this, myClassName, LOGOUT_ACTION, getAction(LOGIN_ACTION)));
|
||||
registerAction(new FindProfile(this, myClassName, FINDPROFILE_ACTION, getAction(VIEWPROFILE_ACTION)));
|
||||
registerAction(new UpdateProfile(this, myClassName, UPDATEPROFILE_ACTION, getAction(VIEWPROFILE_ACTION)));
|
||||
registerAction(new DeleteProfile(this, myClassName, DELETEPROFILE_ACTION, getAction(LISTSTAFF_ACTION)));
|
||||
}
|
||||
|
||||
protected static String parseClassName(String fqcn)
|
||||
{
|
||||
String className = fqcn;
|
||||
|
||||
int lastDotIndex = fqcn.lastIndexOf('.');
|
||||
if (lastDotIndex > -1)
|
||||
className = fqcn.substring(lastDotIndex + 1);
|
||||
|
||||
return className;
|
||||
}
|
||||
|
||||
protected void registerAction(LessonAction action)
|
||||
{
|
||||
lessonFunctions.put(action.getActionName(), action);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the category attribute of the CommandInjection object
|
||||
*
|
||||
* @return The category value
|
||||
*/
|
||||
public Category getDefaultCategory()
|
||||
{
|
||||
return AbstractLesson.A2;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Gets the hints attribute of the DirectoryScreen object
|
||||
*
|
||||
* @return The hints value
|
||||
*/
|
||||
protected List getHints()
|
||||
{
|
||||
List hints = new ArrayList();
|
||||
hints.add( "Many sites attempt to restrict access to resources by role." );
|
||||
hints.add( "Developers frequently make mistakes implementing this scheme." );
|
||||
hints.add( "Attempt combinations of users, roles, and resources." );
|
||||
|
||||
// Stage 1
|
||||
hints.add( "How does the application know that the user selected the delete function?" );
|
||||
|
||||
// Stage 2
|
||||
|
||||
// Stage 3
|
||||
hints.add( "How does the application know that the user selected any particular employee to view?" );
|
||||
|
||||
// Stage 4
|
||||
hints.add( "Note that the contents of the staff listing change depending on who is logged in." );
|
||||
|
||||
return hints;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Gets the instructions attribute of the ParameterInjection object
|
||||
*
|
||||
* @return The instructions value
|
||||
*/
|
||||
public String getInstructions(WebSession s)
|
||||
{
|
||||
String instructions = "";
|
||||
|
||||
if (!getLessonTracker(s).getCompleted())
|
||||
{
|
||||
switch (getStage(s))
|
||||
{
|
||||
case 1:
|
||||
instructions = "Stage " + getStage(s) + ": Breaking functional access control.<br>" +
|
||||
"You should be able to login as a regular employee and delete another user's employee " +
|
||||
"profile, even though that is supposed to be an HR-only function.";
|
||||
break;
|
||||
case 2:
|
||||
instructions = "Stage " + getStage(s) + ": Implementing access control in the Business Layer<br>"
|
||||
+ "Access control has already been implemented in the Presentation Layer, but as we have just " +
|
||||
"seen, this is not enough. Implement access control in the Businesss Layer to verify " +
|
||||
"authorization to use the Delete function before actually executing it.";
|
||||
break;
|
||||
case 3:
|
||||
instructions = "Stage " + getStage(s) + ": Breaking data access control.<br>" +
|
||||
"Data Layer access control is being already done on the staff list, but it has not been " +
|
||||
"globally implemented. Take advantage of this to login as a regular employee and view the " +
|
||||
"CEO's employee profile.";
|
||||
break;
|
||||
case 4:
|
||||
instructions = "Stage " + getStage(s) + ": Implementing access control in the Data Layer.<br>" +
|
||||
"Implement Data Layer access control to prevent unauthorized (and potentially career threatening) " +
|
||||
"access to employee personal data.";
|
||||
break;
|
||||
default:
|
||||
// Illegal stage value
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
return instructions;
|
||||
}
|
||||
|
||||
|
||||
protected LessonAction getAction(String actionName)
|
||||
{
|
||||
return (LessonAction) lessonFunctions.get(actionName);
|
||||
}
|
||||
|
||||
|
||||
|
||||
public void handleRequest(WebSession s)
|
||||
{
|
||||
// Here is where dispatching to the various action handlers happens.
|
||||
// It would be a good place verify authorization to use an action.
|
||||
|
||||
//System.out.println("RoleBasedAccessControl.handleRequest()");
|
||||
if (s.getLessonSession(this) == null)
|
||||
s.openLessonSession(this);
|
||||
|
||||
String requestedActionName = null;
|
||||
try
|
||||
{
|
||||
requestedActionName = s.getParser().getStringParameter("action");
|
||||
}
|
||||
catch (ParameterNotFoundException pnfe)
|
||||
{
|
||||
// Let them eat login page.
|
||||
requestedActionName = LOGIN_ACTION;
|
||||
}
|
||||
//System.out.println("Requested lesson action: " + requestedActionName);
|
||||
|
||||
try
|
||||
{
|
||||
LessonAction action = getAction(requestedActionName);
|
||||
if (action != null)
|
||||
{
|
||||
//System.out.println("RoleBasedAccessControl.handleRequest() dispatching to: " + action.getActionName());
|
||||
if (!action.requiresAuthentication())
|
||||
{
|
||||
// Access to Login does not require authentication.
|
||||
action.handleRequest(s);
|
||||
}
|
||||
else
|
||||
{
|
||||
if (action.isAuthenticated(s))
|
||||
{
|
||||
action.handleRequest(s);
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
}
|
||||
}
|
||||
else
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
}
|
||||
catch (ParameterNotFoundException pnfe)
|
||||
{
|
||||
System.out.println("Missing parameter");
|
||||
pnfe.printStackTrace();
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
}
|
||||
catch (ValidationException ve)
|
||||
{
|
||||
System.out.println("Validation failed");
|
||||
ve.printStackTrace();
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
}
|
||||
catch (UnauthenticatedException ue)
|
||||
{
|
||||
s.setMessage("Login failed");
|
||||
System.out.println("Authentication failure");
|
||||
ue.printStackTrace();
|
||||
}
|
||||
catch (UnauthorizedException ue2)
|
||||
{
|
||||
s.setMessage("You are not authorized to perform this function");
|
||||
System.out.println("Authorization failure");
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
ue2.printStackTrace();
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
// All other errors send the user to the generic error page
|
||||
System.out.println("handleRequest() error");
|
||||
e.printStackTrace();
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
}
|
||||
|
||||
// All this does for this lesson is ensure that a non-null content exists.
|
||||
setContent(new ElementContainer());
|
||||
}
|
||||
|
||||
public void handleRequest_BACKUP(WebSession s)
|
||||
{
|
||||
// Here is where dispatching to the various action handlers happens.
|
||||
// It would be a good place verify authorization to use an action.
|
||||
|
||||
//System.out.println("RoleBasedAccessControl.handleRequest()");
|
||||
if (s.getLessonSession(this) == null)
|
||||
s.openLessonSession(this);
|
||||
|
||||
String requestedActionName = null;
|
||||
try
|
||||
{
|
||||
requestedActionName = s.getParser().getStringParameter("action");
|
||||
}
|
||||
catch (ParameterNotFoundException pnfe)
|
||||
{
|
||||
// Let them eat login page.
|
||||
requestedActionName = LOGIN_ACTION;
|
||||
}
|
||||
//System.out.println("Requested lesson action: " + requestedActionName);
|
||||
|
||||
if (requestedActionName != null)
|
||||
{
|
||||
try
|
||||
{
|
||||
LessonAction action = getAction(requestedActionName);
|
||||
if (action != null)
|
||||
{
|
||||
//System.out.println("RoleBasedAccessControl.handleRequest() dispatching to: " + action.getActionName());
|
||||
if (!action.requiresAuthentication())
|
||||
{
|
||||
// Access to Login does not require authentication.
|
||||
action.handleRequest(s);
|
||||
}
|
||||
else
|
||||
{
|
||||
if (action.isAuthenticated(s))
|
||||
{
|
||||
int userId = action.getUserId(s);
|
||||
if (action.isAuthorized(s, userId, action.getActionName()))
|
||||
{
|
||||
action.handleRequest(s);
|
||||
}
|
||||
else
|
||||
{
|
||||
throw new UnauthorizedException();
|
||||
}
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
}
|
||||
}
|
||||
else
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
}
|
||||
catch (ParameterNotFoundException pnfe)
|
||||
{
|
||||
System.out.println("Missing parameter");
|
||||
pnfe.printStackTrace();
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
}
|
||||
catch (ValidationException ve)
|
||||
{
|
||||
System.out.println("Validation failed");
|
||||
ve.printStackTrace();
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
}
|
||||
catch (UnauthenticatedException ue)
|
||||
{
|
||||
s.setMessage("Login failed");
|
||||
System.out.println("Authentication failure");
|
||||
ue.printStackTrace();
|
||||
}
|
||||
catch (UnauthorizedException ue2)
|
||||
{
|
||||
s.setMessage("You are not authorized to perform this function");
|
||||
System.out.println("Authorization failure");
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
ue2.printStackTrace();
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
// All other errors send the user to the generic error page
|
||||
System.out.println("handleRequest() error");
|
||||
e.printStackTrace();
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
}
|
||||
}
|
||||
|
||||
// All this does for this lesson is ensure that a non-null content exists.
|
||||
setContent(new ElementContainer());
|
||||
}
|
||||
|
||||
public boolean isAuthorized(WebSession s, int userId, String functionId)
|
||||
{
|
||||
//System.out.println("Checking authorization from " + getCurrentAction(s));
|
||||
LessonAction action = (LessonAction) lessonFunctions.get(getCurrentAction(s));
|
||||
return action.isAuthorized(s, userId, functionId);
|
||||
}
|
||||
|
||||
public int getUserId(WebSession s) throws ParameterNotFoundException
|
||||
{
|
||||
LessonAction action = (LessonAction) lessonFunctions.get(getCurrentAction(s));
|
||||
return action.getUserId(s);
|
||||
}
|
||||
|
||||
public String getUserName(WebSession s) throws ParameterNotFoundException
|
||||
{
|
||||
LessonAction action = (LessonAction) lessonFunctions.get(getCurrentAction(s));
|
||||
return action.getUserName(s);
|
||||
}
|
||||
|
||||
public String getTemplatePage(WebSession s)
|
||||
{
|
||||
return JSP_PATH + LESSON_NAME + ".jsp";
|
||||
}
|
||||
|
||||
public String getPage(WebSession s)
|
||||
{
|
||||
String page = JSP_PATH + getCurrentAction(s) + ".jsp";
|
||||
//System.out.println("Retrieved sub-view page for " + this.getClass().getName() + " of " + page);
|
||||
|
||||
return page;
|
||||
}
|
||||
|
||||
protected Integer getDefaultRanking()
|
||||
{
|
||||
return DEFAULT_RANKING;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the DirectoryScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return "LAB: Role Based Access Control";
|
||||
}
|
||||
|
||||
public String getSourceFileName()
|
||||
{
|
||||
// FIXME: Need to generalize findSourceResource() and use it on the currently active
|
||||
// LessonAction delegate to get its source file.
|
||||
//return findSourceResource(getCurrentLessonScreen()....);
|
||||
return super.getSourceFileName();
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,19 @@
|
||||
package org.owasp.webgoat.lessons.RoleBasedAccessControl;
|
||||
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.lessons.DefaultLessonAction;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
public class SearchStaff extends DefaultLessonAction
|
||||
{
|
||||
public SearchStaff(AbstractLesson lesson, String lessonName, String actionName)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
}
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return RoleBasedAccessControl.SEARCHSTAFF_ACTION;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,254 @@
|
||||
package org.owasp.webgoat.lessons.RoleBasedAccessControl;
|
||||
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.sql.Statement;
|
||||
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.lessons.DefaultLessonAction;
|
||||
import org.owasp.webgoat.lessons.LessonAction;
|
||||
import org.owasp.webgoat.session.Employee;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
public class UpdateProfile extends DefaultLessonAction
|
||||
{
|
||||
private LessonAction chainedAction;
|
||||
|
||||
public UpdateProfile(AbstractLesson lesson, String lessonName, String actionName, LessonAction chainedAction)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
this.chainedAction = chainedAction;
|
||||
}
|
||||
|
||||
public void handleRequest( WebSession s )
|
||||
throws ParameterNotFoundException, UnauthenticatedException, UnauthorizedException, ValidationException
|
||||
{
|
||||
if (isAuthenticated(s))
|
||||
{
|
||||
int userId = getIntSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.USER_ID);
|
||||
|
||||
int subjectId = s.getParser().getIntParameter(RoleBasedAccessControl.EMPLOYEE_ID, 0);
|
||||
|
||||
String firstName = s.getParser().getStringParameter(RoleBasedAccessControl.FIRST_NAME);
|
||||
String lastName = s.getParser().getStringParameter(RoleBasedAccessControl.LAST_NAME);
|
||||
String ssn = s.getParser().getStringParameter(RoleBasedAccessControl.SSN);
|
||||
String title = s.getParser().getStringParameter(RoleBasedAccessControl.TITLE);
|
||||
String phone = s.getParser().getStringParameter(RoleBasedAccessControl.PHONE_NUMBER);
|
||||
String address1 = s.getParser().getStringParameter(RoleBasedAccessControl.ADDRESS1);
|
||||
String address2 = s.getParser().getStringParameter(RoleBasedAccessControl.ADDRESS2);
|
||||
int manager = s.getParser().getIntParameter(RoleBasedAccessControl.MANAGER);
|
||||
String startDate = s.getParser().getStringParameter(RoleBasedAccessControl.START_DATE);
|
||||
int salary = s.getParser().getIntParameter(RoleBasedAccessControl.SALARY);
|
||||
String ccn = s.getParser().getStringParameter(RoleBasedAccessControl.CCN);
|
||||
int ccnLimit = s.getParser().getIntParameter(RoleBasedAccessControl.CCN_LIMIT);
|
||||
String disciplinaryActionDate = s.getParser().getStringParameter(RoleBasedAccessControl.DISCIPLINARY_DATE);
|
||||
String disciplinaryActionNotes = s.getParser().getStringParameter(RoleBasedAccessControl.DISCIPLINARY_NOTES);
|
||||
String personalDescription = s.getParser().getStringParameter(RoleBasedAccessControl.DESCRIPTION);
|
||||
|
||||
Employee employee = new Employee(subjectId, firstName, lastName, ssn, title, phone,
|
||||
address1, address2, manager, startDate, salary,
|
||||
ccn, ccnLimit, disciplinaryActionDate, disciplinaryActionNotes,
|
||||
personalDescription);
|
||||
|
||||
if (subjectId > 0)
|
||||
{
|
||||
this.changeEmployeeProfile(s, userId, subjectId, employee);
|
||||
setRequestAttribute(s, getLessonName() + "." + RoleBasedAccessControl.EMPLOYEE_ID, Integer.toString(subjectId));
|
||||
}
|
||||
else
|
||||
this.createEmployeeProfile(s, userId, employee);
|
||||
|
||||
try
|
||||
{
|
||||
chainedAction.handleRequest(s);
|
||||
}
|
||||
catch (UnauthenticatedException ue1)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue1.printStackTrace();
|
||||
}
|
||||
catch (UnauthorizedException ue2)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue2.printStackTrace();
|
||||
}
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
}
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return RoleBasedAccessControl.VIEWPROFILE_ACTION;
|
||||
}
|
||||
|
||||
|
||||
public void changeEmployeeProfile(WebSession s, int userId, int subjectId, Employee employee)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
try
|
||||
{
|
||||
// Note: The password field is ONLY set by ChangePassword
|
||||
String query = "UPDATE employee SET first_name = '" + employee.getFirstName() +
|
||||
"', last_name = '" + employee.getLastName() +
|
||||
"', ssn = '" + employee.getSsn() +
|
||||
"', title = '" + employee.getTitle() +
|
||||
"', phone = '" + employee.getPhoneNumber() +
|
||||
"', address1 = '" + employee.getAddress1() +
|
||||
"', address2 = '" + employee.getAddress2() +
|
||||
"', manager = " + employee.getManager() +
|
||||
", start_date = '" + employee.getStartDate() +
|
||||
"', ccn = '" + employee.getCcn() +
|
||||
"', ccn_limit = " + employee.getCcnLimit() +
|
||||
// "', disciplined_date = '" + employee.getDisciplinaryActionDate() +
|
||||
// "', disciplined_notes = '" + employee.getDisciplinaryActionNotes() +
|
||||
", personal_description = '" + employee.getPersonalDescription() +
|
||||
"' WHERE userid = " + subjectId;
|
||||
//System.out.println("Query: " + query);
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s).createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
ResultSet answer_results = answer_statement.executeQuery( query );
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error updating employee profile" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error updating employee profile" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public void changeEmployeeProfile_BACKUP(WebSession s, int userId, int subjectId, Employee employee)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
try
|
||||
{
|
||||
// Note: The password field is ONLY set by ChangePassword
|
||||
String query = "UPDATE employee SET first_name = '" + employee.getFirstName() +
|
||||
"', last_name = '" + employee.getLastName() +
|
||||
"', ssn = '" + employee.getSsn() +
|
||||
"', title = '" + employee.getTitle() +
|
||||
"', phone = '" + employee.getPhoneNumber() +
|
||||
"', address1 = '" + employee.getAddress1() +
|
||||
"', address2 = '" + employee.getAddress2() +
|
||||
"', manager = " + employee.getManager() +
|
||||
", start_date = '" + employee.getStartDate() +
|
||||
"', ccn = '" + employee.getCcn() +
|
||||
"', ccn_limit = " + employee.getCcnLimit() +
|
||||
// "', disciplined_date = '" + employee.getDisciplinaryActionDate() +
|
||||
// "', disciplined_notes = '" + employee.getDisciplinaryActionNotes() +
|
||||
", personal_description = '" + employee.getPersonalDescription() +
|
||||
"' WHERE userid = " + subjectId;
|
||||
//System.out.println("Query: " + query);
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s).createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
ResultSet answer_results = answer_statement.executeQuery( query );
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error updating employee profile" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error updating employee profile" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
private int getNextUID(WebSession s)
|
||||
{
|
||||
int uid = -1;
|
||||
try
|
||||
{
|
||||
Statement statement = WebSession.getConnection(s).createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
|
||||
ResultSet results = statement.executeQuery("select max(userid) as uid from employee");
|
||||
results.first();
|
||||
uid = results.getInt("uid");
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
sqle.printStackTrace();
|
||||
s.setMessage( "Error updating employee profile" );
|
||||
} catch (ClassNotFoundException e) {
|
||||
// TODO Auto-generated catch block
|
||||
e.printStackTrace();
|
||||
}
|
||||
return uid + 1;
|
||||
}
|
||||
|
||||
|
||||
public void createEmployeeProfile(WebSession s, int userId, Employee employee)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
try
|
||||
{
|
||||
int newUID = getNextUID(s);
|
||||
// FIXME: This max() thing doesn't work on InstantDB.
|
||||
String query = "INSERT INTO employee VALUES (" + newUID + ", '"
|
||||
+ employee.getFirstName() + "','"
|
||||
+ employee.getLastName() + "','"
|
||||
+ employee.getSsn() + "','goober57x','"
|
||||
+ employee.getTitle() + "','"
|
||||
+ employee.getPhoneNumber() + "','"
|
||||
+ employee.getAddress1() + "','"
|
||||
+ employee.getAddress2() + "',"
|
||||
+ employee.getManager() + ",'"
|
||||
+ employee.getStartDate() + "',"
|
||||
+ employee.getSalary() + ",'"
|
||||
+ employee.getCcn() + "',"
|
||||
+ employee.getCcnLimit() + ",'"
|
||||
+ employee.getDisciplinaryActionDate() + "','"
|
||||
+ employee.getDisciplinaryActionNotes() + "','"
|
||||
+ employee.getPersonalDescription()
|
||||
+ "')";
|
||||
|
||||
//System.out.println("Query: " + query);
|
||||
|
||||
try
|
||||
{
|
||||
Statement statement = WebSession.getConnection(s).createStatement();
|
||||
statement.executeUpdate(query);
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
sqle.printStackTrace();
|
||||
s.setMessage( "Error updating employee profile" );
|
||||
}
|
||||
|
||||
query = "INSERT INTO roles VALUES (" + newUID + ", 'hr')";
|
||||
|
||||
//System.out.println("Query: " + query);
|
||||
|
||||
try
|
||||
{
|
||||
Statement statement = WebSession.getConnection(s).createStatement();
|
||||
statement.executeUpdate(query);
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
sqle.printStackTrace();
|
||||
s.setMessage( "Error updating employee profile" );
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
e.printStackTrace();
|
||||
s.setMessage( "Error updating employee profile" );
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,185 @@
|
||||
package org.owasp.webgoat.lessons.RoleBasedAccessControl;
|
||||
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.sql.Statement;
|
||||
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.lessons.DefaultLessonAction;
|
||||
import org.owasp.webgoat.session.Employee;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
public class ViewProfile extends DefaultLessonAction
|
||||
{
|
||||
public ViewProfile(AbstractLesson lesson, String lessonName, String actionName)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
}
|
||||
|
||||
public void handleRequest( WebSession s )
|
||||
throws ParameterNotFoundException, UnauthenticatedException, UnauthorizedException
|
||||
{
|
||||
getLesson().setCurrentAction(s, getActionName());
|
||||
|
||||
if (isAuthenticated(s))
|
||||
{
|
||||
int userId = getIntSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.USER_ID);
|
||||
int employeeId = -1;
|
||||
try
|
||||
{
|
||||
// User selected employee
|
||||
employeeId = s.getParser().getIntParameter(RoleBasedAccessControl.EMPLOYEE_ID);
|
||||
}
|
||||
catch (ParameterNotFoundException e)
|
||||
{
|
||||
// May be an internally selected employee
|
||||
employeeId = getIntRequestAttribute(s, getLessonName() + "." + RoleBasedAccessControl.EMPLOYEE_ID);
|
||||
}
|
||||
|
||||
Employee employee = getEmployeeProfile(s, userId, employeeId);
|
||||
setSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.EMPLOYEE_ATTRIBUTE_KEY, employee);
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
|
||||
updateLessonStatus(s);
|
||||
}
|
||||
|
||||
private void updateLessonStatus(WebSession s)
|
||||
{
|
||||
// If the logged in user is not authorized to see the given employee's data, stage is complete.
|
||||
try
|
||||
{
|
||||
int userId = getIntSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.USER_ID);
|
||||
int employeeId = s.getParser().getIntParameter(RoleBasedAccessControl.EMPLOYEE_ID);
|
||||
|
||||
if (getStage(s) == 3 && !isAuthorizedForEmployee(s, userId, employeeId))
|
||||
{
|
||||
s.setMessage( "Welcome to stage 4 -- protecting the data layer" );
|
||||
setStage(s, 4);
|
||||
}
|
||||
}
|
||||
catch (ParameterNotFoundException e)
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return RoleBasedAccessControl.VIEWPROFILE_ACTION;
|
||||
}
|
||||
|
||||
|
||||
public Employee getEmployeeProfile(WebSession s, int userId, int subjectUserId) throws UnauthorizedException
|
||||
{
|
||||
Employee profile = null;
|
||||
|
||||
// Query the database for the profile data of the given employee
|
||||
try
|
||||
{
|
||||
String query = "SELECT * FROM employee WHERE userid = " + subjectUserId;
|
||||
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s).createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
ResultSet answer_results = answer_statement.executeQuery( query );
|
||||
if (answer_results.next())
|
||||
{
|
||||
// Note: Do NOT get the password field.
|
||||
profile = new Employee(
|
||||
answer_results.getInt("userid"),
|
||||
answer_results.getString("first_name"),
|
||||
answer_results.getString("last_name"),
|
||||
answer_results.getString("ssn"),
|
||||
answer_results.getString("title"),
|
||||
answer_results.getString("phone"),
|
||||
answer_results.getString("address1"),
|
||||
answer_results.getString("address2"),
|
||||
answer_results.getInt("manager"),
|
||||
answer_results.getString("start_date"),
|
||||
answer_results.getInt("salary"),
|
||||
answer_results.getString("ccn"),
|
||||
answer_results.getInt("ccn_limit"),
|
||||
answer_results.getString("disciplined_date"),
|
||||
answer_results.getString("disciplined_notes"),
|
||||
answer_results.getString("personal_description"));
|
||||
/* System.out.println("Retrieved employee from db: " +
|
||||
profile.getFirstName() + " " + profile.getLastName() +
|
||||
" (" + profile.getId() + ")");
|
||||
*/ }
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error getting employee profile" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error getting employee profile" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return profile;
|
||||
}
|
||||
|
||||
public Employee getEmployeeProfile_BACKUP(WebSession s, int userId, int subjectUserId)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
// Query the database to determine if the given employee is owned by the given user
|
||||
// Query the database for the profile data of the given employee
|
||||
|
||||
Employee profile = null;
|
||||
|
||||
// Query the database for the profile data of the given employee
|
||||
try
|
||||
{
|
||||
String query = "SELECT * FROM employee WHERE userid = " + subjectUserId;
|
||||
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s).createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
ResultSet answer_results = answer_statement.executeQuery( query );
|
||||
if (answer_results.next())
|
||||
{
|
||||
// Note: Do NOT get the password field.
|
||||
profile = new Employee(
|
||||
answer_results.getInt("userid"),
|
||||
answer_results.getString("first_name"),
|
||||
answer_results.getString("last_name"),
|
||||
answer_results.getString("ssn"),
|
||||
answer_results.getString("title"),
|
||||
answer_results.getString("phone"),
|
||||
answer_results.getString("address1"),
|
||||
answer_results.getString("address2"),
|
||||
answer_results.getInt("manager"),
|
||||
answer_results.getString("start_date"),
|
||||
answer_results.getInt("salary"),
|
||||
answer_results.getString("ccn"),
|
||||
answer_results.getInt("ccn_limit"),
|
||||
answer_results.getString("disciplined_date"),
|
||||
answer_results.getString("disciplined_notes"),
|
||||
answer_results.getString("personal_description"));
|
||||
/* System.out.println("Retrieved employee from db: " +
|
||||
profile.getFirstName() + " " + profile.getLastName() +
|
||||
" (" + profile.getId() + ")");
|
||||
*/ }
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error getting employee profile" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error getting employee profile" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return profile;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user