Refactored files to Maven standard Layout

Added plugin to produce executable jar. Now it is easy to run webgoat on all platforms.

src/main/java/org/owasp/webgoat/service/BaseService.java

@@ -0,0 +1,80 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at code.google.com, a repository
+ * for free software projects.
+ *
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+package org.owasp.webgoat.service;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
+import org.owasp.webgoat.controller.Welcome;
+import org.owasp.webgoat.session.WebSession;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.ResponseStatus;
+
+/**
+ *
+ * @author rlawson
+ */
+@RequestMapping("/service")
+public abstract class BaseService {
+
+    final Logger logger = LoggerFactory.getLogger(BaseService.class);
+
+    @ExceptionHandler(Exception.class)
+    @ResponseStatus(value = HttpStatus.I_AM_A_TEAPOT)
+    public @ResponseBody
+    ExceptionInfo handleException(HttpServletRequest request, Exception ex) {
+        String url = request.getRequestURL().toString();
+        logger.error("Exception handler for service caught exception when processing: " + url, ex);
+        ExceptionInfo response = new ExceptionInfo();
+        response.setUrl(url);
+        response.setMessage(ex.toString());
+
+        return response;
+    }
+
+    public WebSession getWebSession(HttpSession session) {
+        WebSession ws;
+        Object o = session.getAttribute(WebSession.SESSION);
+        if (o == null) {
+            throw new IllegalArgumentException("No valid WebSession object found, has session timed out? [" + session.getId() + "]");
+        }
+        if (!(o instanceof WebSession)) {
+            throw new IllegalArgumentException("Invalid WebSession object found, this is probably a bug! [" + o.getClass() + " | " + session.getId() + "]");
+        }
+        ws = (WebSession) o;
+        return ws;
+    }
+
+}

src/main/java/org/owasp/webgoat/service/CookieService.java

@@ -0,0 +1,61 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at code.google.com, a repository
+ * for free software projects.
+ *
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+package org.owasp.webgoat.service;
+
+import java.util.List;
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpSession;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class CookieService extends BaseService {
+
+    /**
+     * Returns cookies for last attack
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/cookie.mvc", produces = "application/json")
+    public @ResponseBody
+    List<Cookie> showCookies(HttpSession session) {
+        WebSession ws = getWebSession(session);
+        List<Cookie> cookies = ws.getCookiesOnLastRequest();
+        return cookies;
+    }
+}

src/main/java/org/owasp/webgoat/service/DummyService.java

@@ -0,0 +1,51 @@
+/***************************************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at code.google.com, a repository for free software
+ * projects.
+ * 
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+package org.owasp.webgoat.service;
+
+import java.util.ArrayList;
+import java.util.List;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class DummyService extends BaseService{
+
+    @RequestMapping(value = "/first.mvc", produces = "application/json")
+    public @ResponseBody
+    List<String> firstNames() {
+        List<String> test = new ArrayList<String>();
+        test.add("one");
+        test.add("two)");
+        return test;
+    }
+}

src/main/java/org/owasp/webgoat/service/ExceptionInfo.java

@@ -0,0 +1,54 @@
+/***************************************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at code.google.com, a repository for free software
+ * projects.
+ * 
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+package org.owasp.webgoat.service;
+
+/**
+ *
+ * @author rlawson
+ */
+public class ExceptionInfo {
+
+    private String url;
+    private String message;
+
+    public String getUrl() {
+        return url;
+    }
+
+    public void setUrl(String url) {
+        this.url = url;
+    }
+
+    public String getMessage() {
+        return message;
+    }
+
+    public void setMessage(String message) {
+        this.message = message;
+    }
+}

src/main/java/org/owasp/webgoat/service/HintService.java

@@ -0,0 +1,56 @@
+/*
+ * To change this license header, choose License Headers in Project Properties.
+ * To change this template file, choose Tools | Templates
+ * and open the template in the editor.
+ */
+package org.owasp.webgoat.service;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.servlet.http.HttpSession;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.lessons.model.Hint;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class HintService extends BaseService {
+
+    /**
+     * Returns hints for current lesson
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/hint.mvc", produces = "application/json")
+    public @ResponseBody
+    List<Hint> showHint(HttpSession session) {
+        List<Hint> listHints = new ArrayList<Hint>();
+        WebSession ws = getWebSession(session);
+        AbstractLesson l = ws.getCurrentLesson();
+        if (l == null) {
+            return listHints;
+        }
+        List<String> hints;
+        hints = l.getHintsPublic(ws);
+        if (hints == null) {
+            return listHints;
+        }
+        int idx = 0;
+        for (String h : hints) {
+            Hint hint = new Hint();
+            hint.setHint(h);
+            hint.setLesson(l.getName());
+            hint.setNumber(idx);
+            listHints.add(hint);
+            idx++;
+        }
+        return listHints;
+    }
+}

src/main/java/org/owasp/webgoat/service/LessonMenuService.java

@@ -0,0 +1,109 @@
+/***************************************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at code.google.com, a repository for free software
+ * projects.
+ * 
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+package org.owasp.webgoat.service;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.servlet.http.HttpSession;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.lessons.Category;
+import org.owasp.webgoat.lessons.RandomLessonAdapter;
+import org.owasp.webgoat.lessons.model.LessonMenuItem;
+import org.owasp.webgoat.lessons.model.LessonMenuItemType;
+import org.owasp.webgoat.session.Course;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class LessonMenuService extends BaseService {
+
+    /**
+     * Returns the lesson menu which is used to build the left nav
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/lessonmenu.mvc", produces = "application/json")
+    public @ResponseBody
+    List<LessonMenuItem> showLeftNav(HttpSession session) {
+        List<LessonMenuItem> menu = new ArrayList<LessonMenuItem>();
+        WebSession ws = getWebSession(session);
+        // Get the categories, these are the main menu items
+        Course course = ws.getCourse();
+        List<Category> categories = course.getCategories();
+
+        for (Category category : categories) {
+            LessonMenuItem categoryItem = new LessonMenuItem();
+            categoryItem.setName(category.getName());
+            categoryItem.setType(LessonMenuItemType.CATEGORY);
+            // check for any lessons for this category
+            List<AbstractLesson> lessons = ws.getLessons(category);
+            for (AbstractLesson lesson : lessons) {
+                LessonMenuItem lessonItem = new LessonMenuItem();
+                lessonItem.setName(lesson.getTitle());
+                lessonItem.setLink(lesson.getLink());
+                lessonItem.setType(LessonMenuItemType.LESSON);
+                if (lesson.isCompleted(ws)) {
+                    lessonItem.setComplete(true);
+                }
+                categoryItem.addChild(lessonItem);
+                // Does the lesson have stages
+                if (lesson instanceof RandomLessonAdapter) {
+                    RandomLessonAdapter rla = (RandomLessonAdapter) lesson;
+                    String[] stages = rla.getStages();
+                    if (stages != null) {
+                        String lessonLink = lesson.getLink();
+                        int stageIdx = 1;
+                        for (String stage : stages) {
+                            LessonMenuItem stageItem = new LessonMenuItem();
+                            stageItem.setName("Stage " + stageIdx + ": " + stage);
+                            // build the link for the stage
+                            String stageLink = lessonLink + "&stage=" + stageIdx;
+                            stageItem.setLink(stageLink);
+                            stageItem.setType(LessonMenuItemType.STAGE);
+                            if (rla.isStageComplete(ws, stage)) {
+                                stageItem.setComplete(true);
+                            }
+                            lessonItem.addChild(stageItem);
+                            stageIdx++;
+                        }
+                    }
+                }
+            }
+            menu.add(categoryItem);
+        }
+        return menu;
+
+    }
+}

src/main/java/org/owasp/webgoat/service/LessonPlanService.java

@@ -0,0 +1,94 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at code.google.com, a repository
+ * for free software projects.
+ *
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+package org.owasp.webgoat.service;
+
+import javax.servlet.http.HttpSession;
+import static org.owasp.webgoat.LessonSource.END_SOURCE_SKIP;
+import static org.owasp.webgoat.LessonSource.START_SOURCE_SKIP;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.lessons.model.SourceListing;
+import org.owasp.webgoat.session.Course;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class LessonPlanService extends BaseService {
+
+    /**
+     * Returns source for current attack
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/lessonplan.mvc", produces = "application/json")
+    public @ResponseBody
+    SourceListing showSource(HttpSession session) {
+        WebSession ws = getWebSession(session);
+        String source = getSource(ws);
+        SourceListing sl = new SourceListing();
+        sl.setSource(source);
+        return sl;
+    }
+
+    /**
+     * Description of the Method
+     *
+     * @param s Description of the Parameter
+     * @return Description of the Return Value
+     */
+    protected String getSource(WebSession s) {
+
+        String source = null;
+        int scr = s.getCurrentScreen();
+        Course course = s.getCourse();
+
+        if (s.isUser() || s.isChallenge()) {
+
+            AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
+
+            if (lesson != null) {
+                source = lesson.getRawSource(s);
+            }
+        }
+        if (source == null) {
+            return "Source code is not available. Contact "
+                    + s.getWebgoatContext().getFeedbackAddressHTML();
+        }
+        return (source.replaceAll("(?s)" + START_SOURCE_SKIP + ".*" + END_SOURCE_SKIP,
+                "Code Section Deliberately Omitted"));
+    }
+}

src/main/java/org/owasp/webgoat/service/ParameterService.java

@@ -0,0 +1,70 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at code.google.com, a repository
+ * for free software projects.
+ *
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+package org.owasp.webgoat.service;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import javax.servlet.http.HttpSession;
+import org.owasp.webgoat.lessons.model.RequestParameter;
+import org.owasp.webgoat.session.WebSession;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class ParameterService extends BaseService {
+
+    final Logger logger = LoggerFactory.getLogger(ParameterService.class);
+
+    /**
+     * Returns request parameters for last attack
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/parameter.mvc", produces = "application/json")
+    public @ResponseBody
+    List<RequestParameter> showParameters(HttpSession session) {
+        List<RequestParameter> listParms = new ArrayList<RequestParameter>();
+        WebSession ws = getWebSession(session);
+        listParms = ws.getParmsOnLastRequest();
+        Collections.sort(listParms);
+        return listParms;
+    }
+}

src/main/java/org/owasp/webgoat/service/SessionService.java

@@ -0,0 +1,57 @@
+/*
+ * To change this license header, choose License Headers in Project Properties.
+ * To change this template file, choose Tools | Templates
+ * and open the template in the editor.
+ */
+package org.owasp.webgoat.service;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Date;
+import java.util.Enumeration;
+import java.util.List;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class SessionService extends BaseService {
+
+    /**
+     * Returns hints for current lesson
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/session.mvc", produces = "application/json")
+    public @ResponseBody
+    String showSession(HttpServletRequest request, HttpSession session) {
+        StringBuilder sb = new StringBuilder();
+        sb.append("id").append(" = ").append(session.getId()).append("\n");
+        sb.append("created").append(" = ").append(new Date(session.getCreationTime())).append("\n");
+        sb.append("last access").append(" = ").append(new Date(session.getLastAccessedTime())).append("\n");
+        sb.append("timeout (secs)").append(" = ").append(session.getMaxInactiveInterval()).append("\n");
+        sb.append("session from cookie?").append(" = ").append(request.isRequestedSessionIdFromCookie()).append("\n");
+        sb.append("session from url?").append(" = ").append(request.isRequestedSessionIdFromURL()).append("\n");
+        sb.append("=====================================\n");
+        // get attributes
+        List<String> attributes = new ArrayList<String>();
+        Enumeration keys = session.getAttributeNames();
+        while (keys.hasMoreElements()) {
+            String name = (String) keys.nextElement();
+            attributes.add(name);
+        }
+        Collections.sort(attributes);
+        for (String attribute : attributes) {
+            String value = session.getAttribute(attribute) + "";
+            sb.append(attribute).append(" = ").append(value).append("\n");
+        }
+        return sb.toString();
+    }
+}

src/main/java/org/owasp/webgoat/service/SolutionService.java

@@ -0,0 +1,85 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at code.google.com, a repository
+ * for free software projects.
+ *
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+package org.owasp.webgoat.service;
+
+import javax.servlet.http.HttpSession;
+import static org.owasp.webgoat.LessonSource.END_SOURCE_SKIP;
+import static org.owasp.webgoat.LessonSource.START_SOURCE_SKIP;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.lessons.model.SourceListing;
+import org.owasp.webgoat.session.Course;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class SolutionService extends BaseService {
+
+    /**
+     * Returns solution for current attack
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/solution.mvc", produces = "text/html")
+    public @ResponseBody
+    String showSolution(HttpSession session) {
+        WebSession ws = getWebSession(session);
+        String source = getSolution(ws);
+        return source;
+    }
+
+    protected String getSolution(WebSession s) {
+
+        String source = null;
+        int scr = s.getCurrentScreen();
+        Course course = s.getCourse();
+
+        if (s.isUser() || s.isChallenge()) {
+
+            AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
+
+            if (lesson != null) {
+                source = lesson.getSolution(s);
+            }
+        }
+        if (source == null) {
+            return "Solution  is not available. Contact "
+                    + s.getWebgoatContext().getFeedbackAddressHTML();
+        }
+        return (source);
+    }
+}

src/main/java/org/owasp/webgoat/service/SourceService.java

@@ -0,0 +1,94 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at code.google.com, a repository
+ * for free software projects.
+ *
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+package org.owasp.webgoat.service;
+
+import javax.servlet.http.HttpSession;
+import static org.owasp.webgoat.LessonSource.END_SOURCE_SKIP;
+import static org.owasp.webgoat.LessonSource.START_SOURCE_SKIP;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.lessons.model.SourceListing;
+import org.owasp.webgoat.session.Course;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class SourceService extends BaseService {
+
+    /**
+     * Returns source for current attack
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/source.mvc", produces = "application/json")
+    public @ResponseBody
+    SourceListing showSource(HttpSession session) {
+        WebSession ws = getWebSession(session);
+        String source = getSource(ws);
+        SourceListing sl = new SourceListing();
+        sl.setSource(source);
+        return sl;
+    }
+
+    /**
+     * Description of the Method
+     *
+     * @param s Description of the Parameter
+     * @return Description of the Return Value
+     */
+    protected String getSource(WebSession s) {
+
+        String source = null;
+        int scr = s.getCurrentScreen();
+        Course course = s.getCourse();
+
+        if (s.isUser() || s.isChallenge()) {
+
+            AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
+
+            if (lesson != null) {
+                source = lesson.getRawSource(s);
+            }
+        }
+        if (source == null) {
+            return "Source code is not available. Contact "
+                    + s.getWebgoatContext().getFeedbackAddressHTML();
+        }
+        return (source.replaceAll("(?s)" + START_SOURCE_SKIP + ".*" + END_SOURCE_SKIP,
+                "Code Section Deliberately Omitted"));
+    }
+}