From 99f75a835c442661db73d7eb89a39666b130f40c Mon Sep 17 00:00:00 2001
From: Nanne Baars <nanne.baars@owasp.org>
Date: Mon, 12 Jun 2017 20:02:21 +0200
Subject: [PATCH] #359 Fixed

---
 .../xxe/src/main/resources/html/XXE.html      | 22 ++++---
 .../xxe/src/main/resources/js/xxe.js          | 61 ++++++++-----------
 2 files changed, 37 insertions(+), 46 deletions(-)

diff --git a/webgoat-lessons/xxe/src/main/resources/html/XXE.html b/webgoat-lessons/xxe/src/main/resources/html/XXE.html
index bbdc2e39a..7b0d74867 100644
--- a/webgoat-lessons/xxe/src/main/resources/html/XXE.html
+++ b/webgoat-lessons/xxe/src/main/resources/html/XXE.html
@@ -53,10 +53,10 @@
                     </div>
                     <div class="post-footer">
                         <div class="input-group">
-                            <input class="form-control" id="commentInputSimple" placeholder="Add a comment"
+                            <input class="form-control input-lg" id="commentInputSimple" placeholder="Add a comment"
                                    type="text"/>
                             <span class="input-group-addon">
-                                <button id="postCommentSimple" class="fa fa-edit" style="font-size: 20px"></button>
+                                <button id="postCommentSimple" class="btn btn-primary">Submit</button>
                             </span>
                         </div>
                         <ul class="comments-list">
@@ -80,8 +80,10 @@
         <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <form class="attack-form" accept-charset="UNKNOWN"
               method="POST" name="form"
-              action="/WebGoat/xxe/content-type"
-              enctype="application/json;charset=UTF-8">
+              prepareData="contentTypeXXE"
+              callback="contentTypeXXECallback"
+              action="xxe/content-type"
+              contentType="application/json">
             <div class="container-fluid">
                 <div class="panel post">
                     <div class="post-heading">
@@ -107,10 +109,10 @@
                     </div>
                     <div class="post-footer">
                         <div class="input-group">
-                            <input class="form-control" id="commentInputContentType" placeholder="Add a comment"
+                            <input class="form-control input-lg" id="commentInputContentType" placeholder="Add a comment"
                                    type="text"/>
                             <span class="input-group-addon">
-                                <i id="postCommentContentType" class="fa fa-edit" style="font-size: 20px"></i>
+                                <button id="postCommentContentType" class="btn btn-primary">Submit</button>
                             </span>
                         </div>
                         <ul class="comments-list">
@@ -143,8 +145,10 @@
         <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <form class="attack-form" accept-charset="UNKNOWN"
               method="POST" name="form"
+              prepareData="blindXXE"
+              callback="blindXXECallback"
               action="/WebGoat/xxe/blind"
-              enctype="application/json;charset=UTF-8">
+              contentType="application/xml">
             <div class="container-fluid">
                 <div class="panel post">
                     <div class="post-heading">
@@ -170,9 +174,9 @@
                     </div>
                     <div class="post-footer">
                         <div class="input-group">
-                            <input class="form-control" id="commentInputBlind" placeholder="Add a comment" type="text"/>
+                            <input class="form-control input-lg" id="commentInputBlind" placeholder="Add a comment" type="text"/>
                             <span class="input-group-addon">
-                                <i id="postCommentBlind" class="fa fa-edit" style="font-size: 20px"></i>
+                                <button id="postCommentBlind" class="btn btn-primary">Submit</button>
                             </span>
                         </div>
                         <ul class="comments-list">
diff --git a/webgoat-lessons/xxe/src/main/resources/js/xxe.js b/webgoat-lessons/xxe/src/main/resources/js/xxe.js
index f0219af89..391101e89 100644
--- a/webgoat-lessons/xxe/src/main/resources/js/xxe.js
+++ b/webgoat-lessons/xxe/src/main/resources/js/xxe.js
@@ -8,6 +8,7 @@ webgoat.customjs.simpleXXE = function () {
 }
 
 webgoat.customjs.simpleXXECallback = function() {
+    $("#commentInputBlind").val('');
     getComments('#commentsListSimple');
 }
 
@@ -15,50 +16,36 @@ $(document).ready(function () {
     getComments('#commentsListSimple');
 });
 
+webgoat.customjs.blindXXE = function() {
+    var commentInput = $("#commentInputBlind").val();
+    var xml = '<?xml version="1.0"?>' +
+        '<comment>' +
+        '  <text>' + commentInput + '</text>' +
+        '</comment>';
+    return xml;
+}
+
+webgoat.customjs.blindXXECallback = function() {
+    $("#commentInputBlind").val('');
+    getComments('#commentsListBlind');
+}
+
 $(document).ready(function () {
-    $("#postCommentBlind").unbind();
-    $("#postCommentBlind").on("click", function () {
-        var commentInput = $("#commentInputBlind").val();
-        var xml = '<?xml version="1.0"?>' +
-            '<comment>' +
-            '  <text>' + commentInput + '</text>' +
-            '</comment>';
-        $.ajax({
-            type: 'POST',
-            url: 'xxe/blind',
-            data: xml,
-            contentType: "application/xml",
-            dataType: 'xml',
-            complete: function (data) {
-                $("#commentInputBlind").val('');
-                getComments('#commentsListBlind')
-            }
-        })
-    });
     getComments('#commentsListBlind');
 });
 
-$(document).ready(function () {
-    $("#postCommentContentType").unbind();
-    $("#postCommentContentType").on("click", function () {
-        var commentInput = $("#commentInputContentType").val();
-        $.ajax({
-            type: 'POST',
-            url: 'xxe/content-type',
-            data: JSON.stringify({text: commentInput}),
-            contentType: "application/json",
-            dataType: 'xml',
-            complete: function (data) {
-                $("#commentInputContentType").val('');
-                getComments('#commentsListContentType')
-            }
-        })
-    });
+webgoat.customjs.contentTypeXXE = function() {
+    var commentInput = $("#commentInputContentType").val();
+    return JSON.stringify({text: commentInput});
+}
+
+webgoat.customjs.contentTypeXXECallback = function() {
+    $("#commentInputContentType").val('');
     getComments('#commentsListContentType');
-});
+}
 
 $(document).ready(function () {
-    getComments();
+    getComments('#commentsListContentType');
 });
 
 var html = '<li class="comment">' +