diff --git a/webgoat-lessons/pom.xml b/webgoat-lessons/pom.xml index 73e6651cc..16cb5d107 100644 --- a/webgoat-lessons/pom.xml +++ b/webgoat-lessons/pom.xml @@ -44,6 +44,30 @@ tests test + + junit + junit + ${junit.version} + jar + test + + + org.mockito + mockito-core + 1.10.19 + test + + + org.springframework.boot + spring-boot-starter-test + test + + + org.springframework.security + spring-security-test + 4.1.3.RELEASE + test + diff --git a/webgoat-lessons/vulnerable-components/pom.xml b/webgoat-lessons/vulnerable-components/pom.xml index a9b59e98f..ff124ffcf 100644 --- a/webgoat-lessons/vulnerable-components/pom.xml +++ b/webgoat-lessons/vulnerable-components/pom.xml @@ -11,9 +11,14 @@ com.thoughtworks.xstream - XStream + xstream 1.4.7 - + + junit + junit + + + diff --git a/webgoat-lessons/vulnerable-components/src/main/java/org/owasp/webgoat/plugin/VulnerableComponentsLesson.java b/webgoat-lessons/vulnerable-components/src/main/java/org/owasp/webgoat/plugin/VulnerableComponentsLesson.java index 93588e7ff..80933dfa2 100644 --- a/webgoat-lessons/vulnerable-components/src/main/java/org/owasp/webgoat/plugin/VulnerableComponentsLesson.java +++ b/webgoat-lessons/vulnerable-components/src/main/java/org/owasp/webgoat/plugin/VulnerableComponentsLesson.java @@ -1,17 +1,15 @@ package org.owasp.webgoat.plugin; -import java.io.IOException; - -import javax.servlet.http.HttpServletRequest; - +import com.thoughtworks.xstream.XStream; import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AttackResult; +import org.springframework.web.bind.annotation.RequestBody; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; -import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.ResponseBody; -import com.thoughtworks.xstream.XStream; + +import java.io.IOException; /** * ************************************************************************************************* @@ -51,11 +49,11 @@ import com.thoughtworks.xstream.XStream; public class VulnerableComponentsLesson extends AssignmentEndpoint { @RequestMapping(method = RequestMethod.POST) - public @ResponseBody AttackResult completed(@RequestParam String payload) throws IOException { + public @ResponseBody AttackResult completed(@RequestBody String payload) throws IOException { String process = "open"; String arguments = "/Applications/Calculator.app"; - String payload2 = "" + + String payload2 = "" + "foo" + "" + "java.lang.Comparable" + diff --git a/webgoat-lessons/vulnerable-components/src/main/resources/plugin/VulnerableComponents/html/VulnerableComponents.html b/webgoat-lessons/vulnerable-components/src/main/resources/plugin/VulnerableComponents/html/VulnerableComponents.html index 440af19be..e35a3d6f4 100644 --- a/webgoat-lessons/vulnerable-components/src/main/resources/plugin/VulnerableComponents/html/VulnerableComponents.html +++ b/webgoat-lessons/vulnerable-components/src/main/resources/plugin/VulnerableComponents/html/VulnerableComponents.html @@ -131,23 +131,35 @@
+
+ +
+ + + +
+ Enter Your XML payload: +
+ +
+
+ +
+ +
+ + +
-
-
- - Enter Your XML payload: - -
- +
diff --git a/webgoat-lessons/vulnerable-components/src/test/java/org/owasp/webgoat/plugin/VulnerableComponentsLessonTest.java b/webgoat-lessons/vulnerable-components/src/test/java/org/owasp/webgoat/plugin/VulnerableComponentsLessonTest.java new file mode 100644 index 000000000..6fea21f91 --- /dev/null +++ b/webgoat-lessons/vulnerable-components/src/test/java/org/owasp/webgoat/plugin/VulnerableComponentsLessonTest.java @@ -0,0 +1,60 @@ +/* + * This file is part of WebGoat, an Open Web Application Security Project utility. For details, + * please see http://www.owasp.org/ + *

+ * Copyright (c) 2002 - 2017 Bruce Mayhew + *

+ * This program is free software; you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + *

+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + *

+ * You should have received a copy of the GNU General Public License along with this program; if + * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA + * 02111-1307, USA. + *

+ * Getting Source ============== + *

+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software + * projects. + *

+ */ + +package org.owasp.webgoat.plugin; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.owasp.webgoat.assignments.AssignmentEndpointTest; +import org.springframework.test.web.servlet.MockMvc; + +import static org.springframework.test.web.servlet.setup.MockMvcBuilders.standaloneSetup; + +/** + * @author nbaars + * @date 2/7/17 + */ +@RunWith(MockitoJUnitRunner.class) +public class VulnerableComponentsLessonTest extends AssignmentEndpointTest { + + private MockMvc mockMvc; + + @Before + public void setup() { + VulnerableComponentsLesson vulnerableComponentsLesson = new VulnerableComponentsLesson(); + init(vulnerableComponentsLesson); + this.mockMvc = standaloneSetup(vulnerableComponentsLesson).build(); + } + + @Test + public void success() throws Exception { +// mockMvc.perform(MockMvcRequestBuilders.post("/VulnerableComponents/attack1").content("Test")) +// .andExpect(status().isOk()).andDo(MockMvcResultHandlers.print()) +// .andExpect(jsonPath("$.feedback", CoreMatchers.is(messages.getMessage("http-proxies.intercept.success")))) +// .andExpect(jsonPath("$.lessonCompleted", CoreMatchers.is(true))); + } +} \ No newline at end of file