Refactored files to Maven standard Layout
Added plugin to produce executable jar. Now it is easy to run webgoat on all platforms.
This commit is contained in:
Dave
53
src/main/java/org/owasp/webgoat/session/Authorization.java
Normal file
53
src/main/java/org/owasp/webgoat/session/Authorization.java
Normal file
@ -0,0 +1,53 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.util.Hashtable;
|
||||
import java.util.Map;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class Authorization
|
||||
{
|
||||
|
||||
Map<Integer, Integer> permissions = new Hashtable<Integer, Integer>();
|
||||
|
||||
public Authorization()
|
||||
{
|
||||
}
|
||||
|
||||
public void setPermission(int userId, int functionId)
|
||||
{
|
||||
permissions.put(new Integer(userId), new Integer(functionId));
|
||||
}
|
||||
|
||||
public boolean isAllowed(int userId, int functionId)
|
||||
{
|
||||
return (permissions.get(new Integer(userId)) != null);
|
||||
}
|
||||
}
|
||||
395
src/main/java/org/owasp/webgoat/session/Course.java
Normal file
395
src/main/java/org/owasp/webgoat/session/Course.java
Normal file
@ -0,0 +1,395 @@
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.io.File;
|
||||
import java.io.IOException;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Collections;
|
||||
import java.util.Iterator;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
import java.util.LinkedList;
|
||||
import javax.servlet.ServletContext;
|
||||
import org.owasp.webgoat.HammerHead;
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.lessons.Category;
|
||||
import org.owasp.webgoat.util.WebGoatI18N;
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
|
||||
/**
|
||||
* *************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class Course {
|
||||
|
||||
final Logger logger = LoggerFactory.getLogger(Course.class);
|
||||
|
||||
private final List<AbstractLesson> lessons = new LinkedList<AbstractLesson>();
|
||||
|
||||
private final static String PROPERTIES_FILENAME = HammerHead.propertiesPath;
|
||||
|
||||
private WebgoatProperties properties = null;
|
||||
|
||||
private final List<String> files = new LinkedList<String>();
|
||||
|
||||
private WebgoatContext webgoatContext;
|
||||
|
||||
public Course() {
|
||||
try {
|
||||
properties = new WebgoatProperties(PROPERTIES_FILENAME);
|
||||
} catch (IOException e) {
|
||||
logger.error("Error loading webgoat properties", e);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Take an absolute file and return the filename.
|
||||
*
|
||||
* Ex. /etc/password becomes password
|
||||
*
|
||||
* @param s
|
||||
* @return the file name
|
||||
*/
|
||||
private static String getFileName(String s) {
|
||||
String fileName = new File(s).getName();
|
||||
|
||||
if (fileName.contains("/")) {
|
||||
fileName = fileName.substring(fileName.lastIndexOf("/"), fileName.length());
|
||||
}
|
||||
|
||||
if (fileName.contains(".")) {
|
||||
fileName = fileName.substring(0, fileName.indexOf("."));
|
||||
}
|
||||
|
||||
return fileName;
|
||||
}
|
||||
|
||||
/**
|
||||
* Take a class name and return the equivalent file name
|
||||
*
|
||||
* Ex. org.owasp.webgoat becomes org/owasp/webgoat.java
|
||||
*
|
||||
* @param className
|
||||
* @return
|
||||
*/
|
||||
private static String getSourceFile(String className) {
|
||||
StringBuilder sb = new StringBuilder();
|
||||
|
||||
sb.append(className.replace(".", "/"));
|
||||
sb.append(".java");
|
||||
|
||||
return sb.toString();
|
||||
}
|
||||
|
||||
/**
|
||||
* Takes a file name and builds the class file name
|
||||
*
|
||||
* @param fileName Description of the Parameter
|
||||
* @param path Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
private static String getClassFile(String fileName, String path) {
|
||||
String ext = ".class";
|
||||
fileName = fileName.trim();
|
||||
|
||||
/**
|
||||
* We do not handle directories. We do not handle files with different
|
||||
* extensions
|
||||
*/
|
||||
if (fileName.endsWith("/") || !fileName.endsWith(ext)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
// if the file is in /WEB-INF/classes strip the dir info off
|
||||
int index = fileName.indexOf("/WEB-INF/classes/");
|
||||
if (index != -1) {
|
||||
fileName = fileName.substring(index + "/WEB-INF/classes/".length(), fileName.length() - ext.length());
|
||||
fileName = fileName.replace('/', '.');
|
||||
fileName = fileName.replace('\\', '.');
|
||||
} else {
|
||||
// Strip off the leading path info
|
||||
fileName = fileName.substring(path.length(), fileName.length() - ext.length());
|
||||
}
|
||||
|
||||
return fileName;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the categories attribute of the Course object
|
||||
*
|
||||
* @return The categories value
|
||||
*/
|
||||
public List getCategories() {
|
||||
List<Category> categories = new ArrayList<Category>();
|
||||
for (AbstractLesson lesson : lessons) {
|
||||
if (!categories.contains(lesson.getCategory())) {
|
||||
categories.add(lesson.getCategory());
|
||||
}
|
||||
}
|
||||
|
||||
Collections.sort(categories);
|
||||
|
||||
return categories;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the firstLesson attribute of the Course object
|
||||
*
|
||||
* @return The firstLesson value
|
||||
*/
|
||||
public AbstractLesson getFirstLesson() {
|
||||
List<String> roles = new ArrayList<String>();
|
||||
roles.add(AbstractLesson.USER_ROLE);
|
||||
// Category 0 is the admin function. We want the first real category
|
||||
// to be returned. This is noramally the General category and the Http Basics lesson
|
||||
return ((AbstractLesson) getLessons((Category) getCategories().get(0), roles).get(0));
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the lesson attribute of the Course object
|
||||
*
|
||||
* @param s
|
||||
* @param lessonId Description of the Parameter
|
||||
* @param roles
|
||||
* @return The lesson value
|
||||
*/
|
||||
public AbstractLesson getLesson(WebSession s, int lessonId, List<String> roles) {
|
||||
if (s.isHackedAdmin()) {
|
||||
roles.add(AbstractLesson.HACKED_ADMIN_ROLE);
|
||||
}
|
||||
// System.out.println("getLesson() with roles: " + roles);
|
||||
Iterator<AbstractLesson> iter = lessons.iterator();
|
||||
|
||||
while (iter.hasNext()) {
|
||||
AbstractLesson lesson = iter.next();
|
||||
|
||||
// System.out.println("getLesson() at role: " + lesson.getRole());
|
||||
if (lesson.getScreenId() == lessonId && roles.contains(lesson.getRole())) {
|
||||
return lesson;
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
public AbstractLesson getLesson(WebSession s, int lessonId, String role) {
|
||||
List<String> roles = new ArrayList<String>();
|
||||
roles.add(role);
|
||||
return getLesson(s, lessonId, roles);
|
||||
}
|
||||
|
||||
public List getLessons(WebSession s, String role) {
|
||||
List<String> roles = new ArrayList<String>();
|
||||
roles.add(role);
|
||||
return getLessons(s, roles);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the lessons attribute of the Course object
|
||||
*
|
||||
* @param s
|
||||
* @param roles
|
||||
* @return The lessons value
|
||||
*/
|
||||
public List<AbstractLesson> getLessons(WebSession s, List<String> roles) {
|
||||
if (s.isHackedAdmin()) {
|
||||
roles.add(AbstractLesson.HACKED_ADMIN_ROLE);
|
||||
}
|
||||
List<AbstractLesson> lessonList = new ArrayList<AbstractLesson>();
|
||||
Iterator categoryIter = getCategories().iterator();
|
||||
|
||||
while (categoryIter.hasNext()) {
|
||||
lessonList.addAll(getLessons(s, (Category) categoryIter.next(), roles));
|
||||
}
|
||||
return lessonList;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the lessons attribute of the Course object
|
||||
*
|
||||
* @param category Description of the Parameter
|
||||
* @param role Description of the Parameter
|
||||
* @return The lessons value
|
||||
*/
|
||||
private List<AbstractLesson> getLessons(Category category, List roles) {
|
||||
List<AbstractLesson> lessonList = new ArrayList<AbstractLesson>();
|
||||
|
||||
for (AbstractLesson lesson : lessons) {
|
||||
if (lesson.getCategory().equals(category) && roles.contains(lesson.getRole())) {
|
||||
lessonList.add(lesson);
|
||||
}
|
||||
}
|
||||
|
||||
Collections.sort(lessonList);
|
||||
// System.out.println(java.util.Arrays.asList(lessonList));
|
||||
return lessonList;
|
||||
}
|
||||
|
||||
public List getLessons(WebSession s, Category category, String role) {
|
||||
List<String> roles = new ArrayList<String>();
|
||||
roles.add(role);
|
||||
return getLessons(s, category, roles);
|
||||
}
|
||||
|
||||
public List<AbstractLesson> getLessons(WebSession s, Category category, List<String> roles) {
|
||||
if (s.isHackedAdmin()) {
|
||||
roles.add(AbstractLesson.HACKED_ADMIN_ROLE);
|
||||
}
|
||||
return getLessons(category, roles);
|
||||
}
|
||||
|
||||
public AbstractLesson getLesson(int lessonId) {
|
||||
for (AbstractLesson l : lessons) {
|
||||
if (l.getScreenId() == lessonId) {
|
||||
return l;
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Load all of the filenames into a temporary cache
|
||||
*
|
||||
* @param context
|
||||
* @param path
|
||||
*/
|
||||
private void loadFiles(ServletContext context, String path) {
|
||||
logger.debug("Loading files into cache, path: " + path);
|
||||
Set resourcePaths = context.getResourcePaths(path);
|
||||
if (resourcePaths == null) {
|
||||
logger.error("Unable to load file cache for courses, this is probably a bug or configuration issue");
|
||||
return;
|
||||
}
|
||||
Iterator itr = resourcePaths.iterator();
|
||||
|
||||
while (itr.hasNext()) {
|
||||
String file = (String) itr.next();
|
||||
|
||||
if (file.length() != 1 && file.endsWith("/")) {
|
||||
loadFiles(context, file);
|
||||
} else {
|
||||
files.add(file);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Instantiate all the lesson objects into a cache
|
||||
*
|
||||
* @param path
|
||||
*/
|
||||
private void loadLessons(String path) {
|
||||
for (String file : files) {
|
||||
String className = getClassFile(file, path);
|
||||
|
||||
if (className != null && !className.endsWith("_i")) {
|
||||
try {
|
||||
Class c = Class.forName(className);
|
||||
Object o = c.newInstance();
|
||||
|
||||
if (o instanceof AbstractLesson) {
|
||||
AbstractLesson lesson = (AbstractLesson) o;
|
||||
lesson.setWebgoatContext(webgoatContext);
|
||||
|
||||
lesson.update(properties);
|
||||
|
||||
if (lesson.getHidden() == false) {
|
||||
lessons.add(lesson);
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
logger.error("Error in loadLessons: ", e);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private String getLanguageFromFileName(String first, String absoluteFile) {
|
||||
int p1 = absoluteFile.indexOf("/", absoluteFile.indexOf(first) + 1);
|
||||
int p2 = absoluteFile.indexOf("/", p1 + 1);
|
||||
String langStr = absoluteFile.substring(p1 + 1, p2);
|
||||
|
||||
return langStr;
|
||||
}
|
||||
|
||||
/**
|
||||
* For each lesson, set the source file and lesson file
|
||||
*/
|
||||
private void loadResources() {
|
||||
for (AbstractLesson lesson : lessons) {
|
||||
String className = lesson.getClass().getName();
|
||||
String classFile = getSourceFile(className);
|
||||
|
||||
for (String absoluteFile : files) {
|
||||
String fileName = getFileName(absoluteFile);
|
||||
logger.debug("Course: looking at file: " + absoluteFile);
|
||||
|
||||
if (absoluteFile.endsWith(classFile)) {
|
||||
// System.out.println("Set source file for " + classFile);
|
||||
lesson.setSourceFileName(absoluteFile);
|
||||
}
|
||||
|
||||
if (absoluteFile.startsWith("/lesson_plans") && absoluteFile.endsWith(".html")
|
||||
&& className.endsWith(fileName)) {
|
||||
logger.debug("DEBUG: setting lesson plan file " + absoluteFile + " for lesson "
|
||||
+ lesson.getClass().getName());
|
||||
logger.debug("fileName: " + fileName + " == className: " + className);
|
||||
String language = getLanguageFromFileName("/lesson_plans", absoluteFile);
|
||||
lesson.setLessonPlanFileName(language, absoluteFile);
|
||||
WebGoatI18N.loadLanguage(language);
|
||||
}
|
||||
if (absoluteFile.startsWith("/lesson_solutions") && absoluteFile.endsWith(".html")
|
||||
&& className.endsWith(fileName)) {
|
||||
logger.debug("DEBUG: setting lesson solution file " + absoluteFile + " for lesson "
|
||||
+ lesson.getClass().getName());
|
||||
logger.debug("fileName: " + fileName + " == className: " + className);
|
||||
lesson.setLessonSolutionFileName(absoluteFile);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param webgoatContext
|
||||
* @param path Description of the Parameter
|
||||
* @param context Description of the Parameter
|
||||
*/
|
||||
public void loadCourses(WebgoatContext webgoatContext, ServletContext context, String path) {
|
||||
logger.info("Loading courses: " + path);
|
||||
this.webgoatContext = webgoatContext;
|
||||
loadFiles(context, path);
|
||||
loadLessons(path);
|
||||
loadResources();
|
||||
}
|
||||
}
|
||||
1038
src/main/java/org/owasp/webgoat/session/CreateDB.java
Normal file
1038
src/main/java/org/owasp/webgoat/session/CreateDB.java
Normal file
File diff suppressed because it is too large
Load Diff
173
src/main/java/org/owasp/webgoat/session/DatabaseUtilities.java
Normal file
173
src/main/java/org/owasp/webgoat/session/DatabaseUtilities.java
Normal file
@ -0,0 +1,173 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.sql.Connection;
|
||||
import java.sql.DriverManager;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.ResultSetMetaData;
|
||||
import java.sql.SQLException;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
import org.apache.ecs.MultiPartElement;
|
||||
import org.apache.ecs.html.B;
|
||||
import org.apache.ecs.html.TD;
|
||||
import org.apache.ecs.html.TR;
|
||||
import org.apache.ecs.html.Table;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
*/
|
||||
public class DatabaseUtilities
|
||||
{
|
||||
|
||||
private static Map<String, Connection> connections = new HashMap<String, Connection>();
|
||||
private static Map<String, Boolean> dbBuilt = new HashMap<String, Boolean>();
|
||||
|
||||
public static Connection getConnection(WebSession s) throws SQLException
|
||||
{
|
||||
return getConnection(s.getUserName(), s.getWebgoatContext());
|
||||
}
|
||||
|
||||
public static synchronized Connection getConnection(String user, WebgoatContext context) throws SQLException
|
||||
{
|
||||
Connection conn = connections.get(user);
|
||||
if (conn != null && !conn.isClosed()) return conn;
|
||||
conn = makeConnection(user, context);
|
||||
connections.put(user, conn);
|
||||
|
||||
if (dbBuilt.get(user) == null)
|
||||
{
|
||||
new CreateDB().makeDB(conn);
|
||||
dbBuilt.put(user, Boolean.TRUE);
|
||||
}
|
||||
|
||||
return conn;
|
||||
}
|
||||
|
||||
public static synchronized void returnConnection(String user)
|
||||
{
|
||||
try
|
||||
{
|
||||
Connection connection = connections.get(user);
|
||||
if (connection == null || connection.isClosed()) return;
|
||||
|
||||
if (connection.getMetaData().getDatabaseProductName().toLowerCase().contains("oracle")) connection.close();
|
||||
} catch (SQLException sqle)
|
||||
{
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
private static Connection makeConnection(String user, WebgoatContext context) throws SQLException
|
||||
{
|
||||
try
|
||||
{
|
||||
Class.forName(context.getDatabaseDriver());
|
||||
|
||||
if (context.getDatabaseConnectionString().contains("hsqldb")) return getHsqldbConnection(user, context);
|
||||
|
||||
String userPrefix = context.getDatabaseUser();
|
||||
String password = context.getDatabasePassword();
|
||||
String url = context.getDatabaseConnectionString();
|
||||
return DriverManager.getConnection(url, userPrefix + "_" + user, password);
|
||||
} catch (ClassNotFoundException cnfe)
|
||||
{
|
||||
cnfe.printStackTrace();
|
||||
throw new SQLException("Couldn't load the database driver: " + cnfe.getLocalizedMessage());
|
||||
}
|
||||
}
|
||||
|
||||
private static Connection getHsqldbConnection(String user, WebgoatContext context) throws ClassNotFoundException,
|
||||
SQLException
|
||||
{
|
||||
String url = context.getDatabaseConnectionString().replaceAll("\\$\\{USER\\}", user);
|
||||
return DriverManager.getConnection(url, "sa", "");
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param results
|
||||
* Description of the Parameter
|
||||
* @param resultsMetaData
|
||||
* Description of the Parameter
|
||||
*
|
||||
* @return Description of the Return Value
|
||||
*
|
||||
* @exception IOException
|
||||
* Description of the Exception
|
||||
* @exception SQLException
|
||||
* Description of the Exception
|
||||
*/
|
||||
public static MultiPartElement writeTable(ResultSet results, ResultSetMetaData resultsMetaData) throws IOException,
|
||||
SQLException
|
||||
{
|
||||
int numColumns = resultsMetaData.getColumnCount();
|
||||
results.beforeFirst();
|
||||
|
||||
if (results.next())
|
||||
{
|
||||
Table t = new Table(1); // 1 = with border
|
||||
t.setCellPadding(1);
|
||||
|
||||
TR tr = new TR();
|
||||
|
||||
for (int i = 1; i < (numColumns + 1); i++)
|
||||
{
|
||||
tr.addElement(new TD(new B(resultsMetaData.getColumnName(i))));
|
||||
}
|
||||
|
||||
t.addElement(tr);
|
||||
results.beforeFirst();
|
||||
|
||||
while (results.next())
|
||||
{
|
||||
TR row = new TR();
|
||||
|
||||
for (int i = 1; i < (numColumns + 1); i++)
|
||||
{
|
||||
String str = results.getString(i);
|
||||
if (str == null) str = "";
|
||||
row.addElement(new TD(str.replaceAll(" ", " ")));
|
||||
}
|
||||
|
||||
t.addElement(row);
|
||||
}
|
||||
|
||||
return (t);
|
||||
}
|
||||
else
|
||||
{
|
||||
return (new B("Query Successful; however no data was returned from this query."));
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
746
src/main/java/org/owasp/webgoat/session/ECSFactory.java
Normal file
746
src/main/java/org/owasp/webgoat/session/ECSFactory.java
Normal file
@ -0,0 +1,746 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.util.Iterator;
|
||||
import java.util.List;
|
||||
import java.util.StringTokenizer;
|
||||
import java.util.Vector;
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.apache.ecs.StringElement;
|
||||
import org.apache.ecs.html.A;
|
||||
import org.apache.ecs.html.BR;
|
||||
import org.apache.ecs.html.H3;
|
||||
import org.apache.ecs.html.Input;
|
||||
import org.apache.ecs.html.Label;
|
||||
import org.apache.ecs.html.Option;
|
||||
import org.apache.ecs.html.P;
|
||||
import org.apache.ecs.html.Select;
|
||||
import org.apache.ecs.html.TD;
|
||||
import org.apache.ecs.html.TH;
|
||||
import org.apache.ecs.html.TR;
|
||||
import org.apache.ecs.html.U;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Jeff Williams (jeff.williams@aspectsecurity.com)
|
||||
* @created October 29, 2003
|
||||
*/
|
||||
|
||||
public class ECSFactory
|
||||
{
|
||||
|
||||
/**
|
||||
* Description of the Field
|
||||
*/
|
||||
|
||||
public final static String ON = "On";
|
||||
|
||||
/**
|
||||
* Description of the Field
|
||||
*/
|
||||
|
||||
public final static String PASSWORD = "Password";
|
||||
|
||||
/**
|
||||
* Don't let anyone instantiate this class
|
||||
*/
|
||||
|
||||
private ECSFactory()
|
||||
{
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param name
|
||||
* Description of the Parameter
|
||||
* @param value
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static Element makeBox(String name, String value)
|
||||
{
|
||||
|
||||
Input i = new Input(Input.CHECKBOX, name, ON);
|
||||
|
||||
i.setChecked(value.equals(ON));
|
||||
|
||||
return (i);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param text
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static Element makeButton(String text)
|
||||
{
|
||||
|
||||
Input b = new Input();
|
||||
|
||||
b.setType(Input.SUBMIT);
|
||||
b.setValue(text);
|
||||
b.setName(Input.SUBMIT);
|
||||
|
||||
return (b);
|
||||
}
|
||||
|
||||
public static Element makeButton(String text, String onClickFunction)
|
||||
{
|
||||
|
||||
Input b = (Input) makeButton(text);
|
||||
b.setOnClick(onClickFunction);
|
||||
|
||||
return (b);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param labeltext
|
||||
* Description of the Parameter
|
||||
* @param value
|
||||
* Description of the Parameter
|
||||
* @param e
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static TR makeField(String labeltext, String value, Element e)
|
||||
{
|
||||
|
||||
TD left = new TD().setAlign("right");
|
||||
|
||||
Label label = new Label().addElement(labeltext);
|
||||
|
||||
left.addElement(label);
|
||||
|
||||
TD right = new TD().setAlign("left");
|
||||
|
||||
right.addElement(e);
|
||||
|
||||
TR row = new TR();
|
||||
|
||||
row.addElement(left);
|
||||
|
||||
row.addElement(right);
|
||||
|
||||
return (row);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param labeltext
|
||||
* Description of the Parameter
|
||||
* @param name
|
||||
* Description of the Parameter
|
||||
* @param value
|
||||
* Description of the Parameter
|
||||
* @param size
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static TR makeField(String labeltext, String name, String value, int size)
|
||||
{
|
||||
|
||||
Input field = new Input().setName(name).setValue(value).setSize(size).setMaxlength(size);
|
||||
|
||||
// double check in case someone means to make a * starred out password field
|
||||
|
||||
if (name.equals(PASSWORD))
|
||||
{
|
||||
|
||||
field.setType(Input.PASSWORD);
|
||||
|
||||
}
|
||||
|
||||
return (makeField(labeltext, value, field));
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param label
|
||||
* Description of the Parameter
|
||||
* @param type
|
||||
* Description of the Parameter
|
||||
* @param name
|
||||
* Description of the Parameter
|
||||
* @param value
|
||||
* Description of the Parameter
|
||||
* @param alignment
|
||||
* Description of the Parameter
|
||||
* @param selected
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static Element makeInput(String label, String type, String name, boolean value, boolean selected,
|
||||
String alignment)
|
||||
{
|
||||
|
||||
return makeInput(label, type, name, new Boolean(value).toString(), selected, alignment);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param label
|
||||
* Description of the Parameter
|
||||
* @param type
|
||||
* Description of the Parameter
|
||||
* @param name
|
||||
* Description of the Parameter
|
||||
* @param value
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static Element makeInput(String label, String type, String name, String value)
|
||||
{
|
||||
|
||||
return makeInput(label, type, name, value, new Boolean(value).booleanValue(), "RIGHT");
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param label
|
||||
* Description of the Parameter
|
||||
* @param type
|
||||
* Description of the Parameter
|
||||
* @param name
|
||||
* Description of the Parameter
|
||||
* @param value
|
||||
* Description of the Parameter
|
||||
* @param alignment
|
||||
* Description of the Parameter
|
||||
* @param selected
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static Element makeInput(String label, String type, String name, String value, boolean selected,
|
||||
String alignment)
|
||||
{
|
||||
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
if (!alignment.equalsIgnoreCase("LEFT"))
|
||||
{
|
||||
|
||||
ec.addElement(new StringElement(label));
|
||||
|
||||
}
|
||||
|
||||
Input input = new Input(type, name, value);
|
||||
|
||||
ec.addElement(input);
|
||||
|
||||
if (alignment.equalsIgnoreCase("LEFT"))
|
||||
{
|
||||
|
||||
ec.addElement(new StringElement(label));
|
||||
|
||||
}
|
||||
|
||||
if (type.equalsIgnoreCase("CHECKBOX"))
|
||||
{
|
||||
|
||||
input.setChecked(selected);
|
||||
|
||||
}
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param text
|
||||
* Description of the Parameter
|
||||
* @param name
|
||||
* Description of the Parameter
|
||||
* @param value
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static A makeLink(String text, String name, String value)
|
||||
{
|
||||
|
||||
String href = "attack?" + name;
|
||||
|
||||
if (value.length() > 0)
|
||||
{
|
||||
|
||||
href = href + "=" + value;
|
||||
|
||||
}
|
||||
|
||||
A a = new A(href);
|
||||
|
||||
a.addElement(new U().addElement(text));
|
||||
|
||||
a.addAttribute("style", "cursor:hand");
|
||||
|
||||
return (a);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param text
|
||||
* Description of the Parameter
|
||||
* @param name
|
||||
* Description of the Parameter
|
||||
* @param value
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static A makeLink(String text, String name, int value)
|
||||
{
|
||||
|
||||
return (makeLink(text, name, Integer.toString(value)));
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param text
|
||||
* Description of the Parameter
|
||||
* @param name
|
||||
* Description of the Parameter
|
||||
* @param value
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static A makeLink(String text, String name, boolean value)
|
||||
{
|
||||
|
||||
return (makeLink(text, name, new Boolean(value).toString()));
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param text
|
||||
* Description of the Parameter
|
||||
* @param clickAction
|
||||
* Description of the Parameter
|
||||
* @param type
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static Input makeOnClickInput(String text, String clickAction, String type)
|
||||
{
|
||||
|
||||
Input b = new Input();
|
||||
|
||||
b.setType(type);
|
||||
|
||||
b.setValue(text);
|
||||
|
||||
b.setOnClick(clickAction);
|
||||
|
||||
return (b);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param labeltext
|
||||
* Description of the Parameter
|
||||
* @param value
|
||||
* Description of the Parameter
|
||||
* @param e
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static TR makeOption(String labeltext, String value, Element e)
|
||||
{
|
||||
|
||||
TD left = new TD().setAlign("left").setWidth("10%");
|
||||
|
||||
left.addElement(e);
|
||||
|
||||
TD right = new TD().setAlign("right");
|
||||
|
||||
Label label = new Label().addElement(labeltext);
|
||||
|
||||
right.addElement(label);
|
||||
|
||||
TR row = new TR();
|
||||
|
||||
row.addElement(right);
|
||||
|
||||
row.addElement(left);
|
||||
|
||||
return (row);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param label
|
||||
* Description of the Parameter
|
||||
* @param value
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static Option makeOption(String label, boolean value)
|
||||
{
|
||||
|
||||
Option option = new Option(label, new Boolean(value).toString());
|
||||
|
||||
option.setSelected(value);
|
||||
|
||||
return option;
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param line
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
private static org.apache.ecs.html.Option makeOption(String line)
|
||||
{
|
||||
|
||||
StringTokenizer st = new StringTokenizer(line, "|");
|
||||
|
||||
org.apache.ecs.html.Option o = new org.apache.ecs.html.Option();
|
||||
|
||||
String token = "";
|
||||
|
||||
if (st.hasMoreTokens())
|
||||
{
|
||||
|
||||
token = st.nextToken();
|
||||
|
||||
}
|
||||
|
||||
o.addElement(token);
|
||||
|
||||
return (o);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param name
|
||||
* Description of the Parameter
|
||||
* @param options
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static Element makePulldown(String name, List<String> options)
|
||||
{
|
||||
|
||||
Select s = new Select(name);
|
||||
|
||||
s.addElement(options.toArray(new String[options.size()]));
|
||||
|
||||
return (s);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param results
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static Element makePulldown(String name, String results)
|
||||
{
|
||||
|
||||
Select select = new Select(name);
|
||||
|
||||
StringTokenizer st = new StringTokenizer(results, "\n");
|
||||
|
||||
if (!st.hasMoreTokens()) {
|
||||
|
||||
return (new StringElement("")); }
|
||||
|
||||
while (st.hasMoreTokens())
|
||||
{
|
||||
|
||||
String line = st.nextToken();
|
||||
|
||||
select.addElement(makeOption(line));
|
||||
|
||||
}
|
||||
|
||||
select.addElement("-------------------------");
|
||||
|
||||
return (select);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param name
|
||||
* Description of the Parameter
|
||||
* @param list
|
||||
* Description of the Parameter
|
||||
* @param selected
|
||||
* Description of the Parameter
|
||||
* @param rowsShowing
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static Select makePulldown(String name, Object[] list, String selected, int rowsShowing)
|
||||
{
|
||||
|
||||
Select select = new Select(name);
|
||||
|
||||
for (int loop = 0; loop < list.length; loop++)
|
||||
{
|
||||
|
||||
String value = list[loop].toString();
|
||||
|
||||
org.apache.ecs.html.Option o = new org.apache.ecs.html.Option(value, value, value);
|
||||
|
||||
if (value.equals(selected))
|
||||
{
|
||||
|
||||
o.setSelected(true);
|
||||
|
||||
}
|
||||
|
||||
select.addElement(o);
|
||||
|
||||
}
|
||||
|
||||
select.setSize(rowsShowing);
|
||||
|
||||
return select;
|
||||
}
|
||||
|
||||
/**
|
||||
* Default size of 1 for rows showing in select box.
|
||||
*
|
||||
* @param diffNames
|
||||
* Description of the Parameter
|
||||
* @param select
|
||||
* Description of the Parameter
|
||||
* @param name
|
||||
* Description of the Parameter
|
||||
* @param options
|
||||
* Description of the Parameter
|
||||
* @param list
|
||||
* Description of the Parameter
|
||||
* @param selected
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static Element makeSelect(boolean diffNames, Select select, String name, Vector<Option> options,
|
||||
String[] list, String selected)
|
||||
{
|
||||
|
||||
return makeSelect(diffNames, select, name, options, list, selected, 1);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param diffNames
|
||||
* Description of the Parameter
|
||||
* @param select
|
||||
* Description of the Parameter
|
||||
* @param name
|
||||
* Description of the Parameter
|
||||
* @param options
|
||||
* Description of the Parameter
|
||||
* @param list
|
||||
* Description of the Parameter
|
||||
* @param selected
|
||||
* Description of the Parameter
|
||||
* @param rowsShowing
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static Select makeSelect(boolean diffNames, Select select, String name, Vector<Option> options,
|
||||
String[] list, String selected, int rowsShowing)
|
||||
{
|
||||
|
||||
if (select == null)
|
||||
{
|
||||
|
||||
select = new Select(name);
|
||||
|
||||
if (diffNames)
|
||||
{
|
||||
|
||||
for (int loop = 0; loop < list.length; loop += 2)
|
||||
{
|
||||
|
||||
String value = list[loop];
|
||||
|
||||
String label = list[loop + 1];
|
||||
|
||||
Option o = new Option(value);
|
||||
|
||||
if (loop == 0)
|
||||
{
|
||||
|
||||
o.setSelected(true);
|
||||
|
||||
}
|
||||
|
||||
options.addElement(o);// add to Vector containing all options
|
||||
|
||||
select.addElement(o);
|
||||
|
||||
select.addElement(label);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
else
|
||||
{
|
||||
|
||||
for (int loop = 0; loop < list.length; loop++)
|
||||
{
|
||||
|
||||
String value = list[loop];
|
||||
|
||||
org.apache.ecs.html.Option o = new org.apache.ecs.html.Option(value);
|
||||
|
||||
if (loop == 0)
|
||||
{
|
||||
|
||||
o.setSelected(true);
|
||||
|
||||
}
|
||||
|
||||
options.addElement(o);// add to Vector containing all options
|
||||
|
||||
select.addElement(o);
|
||||
|
||||
select.addElement(value);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
// find selected option and set selected
|
||||
|
||||
Iterator i = options.iterator();
|
||||
|
||||
while (i.hasNext())
|
||||
{
|
||||
|
||||
org.apache.ecs.html.Option o = (org.apache.ecs.html.Option) i.next();
|
||||
|
||||
if (selected.equalsIgnoreCase(o.getAttribute("value")))
|
||||
{
|
||||
|
||||
o.setSelected(true);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
select.setSize(rowsShowing);
|
||||
|
||||
return (select);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param title
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public static Element makeTallHeader(String title)
|
||||
{
|
||||
StringBuffer buff = new StringBuffer();
|
||||
for (int i = 0; i < title.length(); i++)
|
||||
{
|
||||
buff.append(title.charAt(i));
|
||||
buff.append("<BR>");
|
||||
}
|
||||
return new TH(buff.toString());
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param title
|
||||
* Description of the Parameter
|
||||
* @param text
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
|
||||
public static Element makeTextArea(String title, String text)
|
||||
{
|
||||
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
ec.addElement(new BR());
|
||||
|
||||
ec.addElement(new H3().addElement(title));
|
||||
|
||||
ec.addElement(new P());
|
||||
|
||||
ec.addElement("<CENTER><TEXTAREA ROWS=10 COLS=90 READONLY>" + text + "</TEXTAREA></CENTER>");
|
||||
|
||||
ec.addElement(new BR());
|
||||
|
||||
ec.addElement(new BR());
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
}
|
||||
241
src/main/java/org/owasp/webgoat/session/Employee.java
Normal file
241
src/main/java/org/owasp/webgoat/session/Employee.java
Normal file
@ -0,0 +1,241 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.io.Serializable;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class Employee implements Serializable
|
||||
{
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
private static final long serialVersionUID = -1901957360367218399L;
|
||||
|
||||
public final static String EMPLOYEE_ROLE = "employee";
|
||||
|
||||
public final static String MANAGER_ROLE = "manager";
|
||||
|
||||
public final static String HR_ROLE = "hr";
|
||||
|
||||
private int id;
|
||||
|
||||
private String firstName;
|
||||
|
||||
private String lastName;
|
||||
|
||||
private String title;
|
||||
|
||||
private String ssn;
|
||||
|
||||
private String phone;
|
||||
|
||||
private String address1;
|
||||
|
||||
private String address2;
|
||||
|
||||
private int manager;
|
||||
|
||||
private String startDate;
|
||||
|
||||
private int salary;
|
||||
|
||||
private String ccn;
|
||||
|
||||
private int ccnLimit;
|
||||
|
||||
private String disciplinaryActionDate;
|
||||
|
||||
private String disciplinaryActionNotes;
|
||||
|
||||
private String personalDescription;
|
||||
|
||||
// FIXME: To be deleted
|
||||
public Employee()
|
||||
{
|
||||
}
|
||||
|
||||
public Employee(int id, String firstName, String lastName, String ssn, String title, String phone, String address1,
|
||||
String address2, int manager, String startDate, int salary, String ccn, int ccnLimit,
|
||||
String disciplinaryActionDate, String disciplinaryActionNotes, String personalDescription)
|
||||
{
|
||||
this.id = id;
|
||||
this.firstName = firstName;
|
||||
this.lastName = lastName;
|
||||
this.ssn = ssn;
|
||||
this.title = title;
|
||||
this.phone = phone;
|
||||
this.address1 = address1;
|
||||
this.address2 = address2;
|
||||
this.manager = manager;
|
||||
this.startDate = startDate;
|
||||
this.salary = salary;
|
||||
this.ccn = ccn;
|
||||
this.ccnLimit = ccnLimit;
|
||||
this.disciplinaryActionDate = disciplinaryActionDate;
|
||||
this.disciplinaryActionNotes = disciplinaryActionNotes;
|
||||
this.personalDescription = personalDescription;
|
||||
}
|
||||
|
||||
public String getAddress1()
|
||||
{
|
||||
return address1;
|
||||
}
|
||||
|
||||
public void setAddress1(String address1)
|
||||
{
|
||||
this.address1 = address1;
|
||||
}
|
||||
|
||||
public String getAddress2()
|
||||
{
|
||||
return address2;
|
||||
}
|
||||
|
||||
public void setAddress2(String address2)
|
||||
{
|
||||
this.address2 = address2;
|
||||
}
|
||||
|
||||
public String getCcn()
|
||||
{
|
||||
return ccn;
|
||||
}
|
||||
|
||||
public void setCcn(String ccn)
|
||||
{
|
||||
this.ccn = ccn;
|
||||
}
|
||||
|
||||
public int getCcnLimit()
|
||||
{
|
||||
return ccnLimit;
|
||||
}
|
||||
|
||||
public void setCcnLimit(int ccnLimit)
|
||||
{
|
||||
this.ccnLimit = ccnLimit;
|
||||
}
|
||||
|
||||
public String getFirstName()
|
||||
{
|
||||
return firstName;
|
||||
}
|
||||
|
||||
public void setFirstName(String firstName)
|
||||
{
|
||||
this.firstName = firstName;
|
||||
}
|
||||
|
||||
public String getLastName()
|
||||
{
|
||||
return lastName;
|
||||
}
|
||||
|
||||
public void setLastName(String lastName)
|
||||
{
|
||||
this.lastName = lastName;
|
||||
}
|
||||
|
||||
public String getPhoneNumber()
|
||||
{
|
||||
return phone;
|
||||
}
|
||||
|
||||
public void setPhoneNumber(String phone)
|
||||
{
|
||||
this.phone = phone;
|
||||
}
|
||||
|
||||
public int getSalary()
|
||||
{
|
||||
return salary;
|
||||
}
|
||||
|
||||
public void setSalary(int salary)
|
||||
{
|
||||
this.salary = salary;
|
||||
}
|
||||
|
||||
public String getSsn()
|
||||
{
|
||||
return ssn;
|
||||
}
|
||||
|
||||
public void setSsn(String ssn)
|
||||
{
|
||||
this.ssn = ssn;
|
||||
}
|
||||
|
||||
public String getStartDate()
|
||||
{
|
||||
return startDate;
|
||||
}
|
||||
|
||||
public void setStartDate(String startDate)
|
||||
{
|
||||
this.startDate = startDate;
|
||||
}
|
||||
|
||||
public int getId()
|
||||
{
|
||||
return id;
|
||||
}
|
||||
|
||||
public void setId(int id)
|
||||
{
|
||||
this.id = id;
|
||||
}
|
||||
|
||||
public String getTitle()
|
||||
{
|
||||
return this.title;
|
||||
}
|
||||
|
||||
public int getManager()
|
||||
{
|
||||
return this.manager;
|
||||
}
|
||||
|
||||
public String getDisciplinaryActionDate()
|
||||
{
|
||||
return this.disciplinaryActionDate;
|
||||
}
|
||||
|
||||
public String getDisciplinaryActionNotes()
|
||||
{
|
||||
return this.disciplinaryActionNotes;
|
||||
}
|
||||
|
||||
public String getPersonalDescription()
|
||||
{
|
||||
return this.personalDescription;
|
||||
}
|
||||
}
|
||||
82
src/main/java/org/owasp/webgoat/session/EmployeeStub.java
Normal file
82
src/main/java/org/owasp/webgoat/session/EmployeeStub.java
Normal file
@ -0,0 +1,82 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.io.Serializable;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class EmployeeStub implements Serializable
|
||||
{
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
private static final long serialVersionUID = -7109162877797765632L;
|
||||
|
||||
private int id;
|
||||
|
||||
private String firstName;
|
||||
|
||||
private String lastName;
|
||||
|
||||
private String role;
|
||||
|
||||
public EmployeeStub(int id, String firstName, String lastName)
|
||||
{
|
||||
this(id, firstName, lastName, Employee.EMPLOYEE_ROLE);
|
||||
}
|
||||
|
||||
public EmployeeStub(int id, String firstName, String lastName, String role)
|
||||
{
|
||||
this.id = id;
|
||||
this.firstName = firstName;
|
||||
this.lastName = lastName;
|
||||
this.role = role;
|
||||
}
|
||||
|
||||
public String getFirstName()
|
||||
{
|
||||
return firstName;
|
||||
}
|
||||
|
||||
public int getId()
|
||||
{
|
||||
return id;
|
||||
}
|
||||
|
||||
public String getLastName()
|
||||
{
|
||||
return lastName;
|
||||
}
|
||||
|
||||
public String getRole()
|
||||
{
|
||||
return role;
|
||||
}
|
||||
}
|
||||
269
src/main/java/org/owasp/webgoat/session/ErrorScreen.java
Normal file
269
src/main/java/org/owasp/webgoat/session/ErrorScreen.java
Normal file
@ -0,0 +1,269 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.PrintWriter;
|
||||
import java.util.StringTokenizer;
|
||||
import javax.servlet.ServletException;
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.apache.ecs.HtmlColor;
|
||||
import org.apache.ecs.StringElement;
|
||||
import org.apache.ecs.html.Div;
|
||||
import org.apache.ecs.html.Form;
|
||||
import org.apache.ecs.html.H2;
|
||||
import org.apache.ecs.html.Small;
|
||||
import org.apache.ecs.html.TD;
|
||||
import org.apache.ecs.html.TR;
|
||||
import org.apache.ecs.html.Table;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
* @created November 4, 2003
|
||||
*/
|
||||
public class ErrorScreen extends Screen
|
||||
{
|
||||
/**
|
||||
* Description of the Field
|
||||
*/
|
||||
protected Throwable error;
|
||||
|
||||
/**
|
||||
* Description of the Field
|
||||
*/
|
||||
protected String message;
|
||||
|
||||
/**
|
||||
* Constructor for the ErrorScreen object
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @param t
|
||||
* Description of the Parameter
|
||||
*/
|
||||
public ErrorScreen(WebSession s, Throwable t)
|
||||
{
|
||||
this.error = t;
|
||||
fixCurrentScreen(s);
|
||||
setup(s);
|
||||
}
|
||||
|
||||
/**
|
||||
* Constructor for the ErrorScreen object
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @param msg
|
||||
* Description of the Parameter
|
||||
*/
|
||||
public ErrorScreen(WebSession s, String msg)
|
||||
{
|
||||
this.message = msg;
|
||||
fixCurrentScreen(s);
|
||||
setup(s);
|
||||
}
|
||||
|
||||
public void fixCurrentScreen(WebSession s)
|
||||
{
|
||||
// So the user can't get stuck on the error screen, reset the
|
||||
// current screen to something known
|
||||
if (s != null)
|
||||
{
|
||||
try
|
||||
{
|
||||
s.setCurrentScreen(s.getCourse().getFirstLesson().getScreenId());
|
||||
} catch (Throwable t)
|
||||
{
|
||||
s.setCurrentScreen(WebSession.WELCOME);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public void setup(WebSession s)
|
||||
{
|
||||
// call createContent first so messages will go somewhere
|
||||
|
||||
Form form = new Form("attack", Form.POST).setName("form").setEncType("");
|
||||
|
||||
form.addElement(wrapForm(s));
|
||||
|
||||
TD lowerright = new TD().setHeight("100%").setVAlign("top").setAlign("left").addElement(form);
|
||||
TR row = new TR().addElement(lowerright);
|
||||
Table layout = new Table().setBgColor(HtmlColor.WHITE).setCellSpacing(0).setCellPadding(0).setBorder(0);
|
||||
|
||||
layout.addElement(row);
|
||||
|
||||
setContent(layout);
|
||||
}
|
||||
|
||||
protected Element wrapForm(WebSession s)
|
||||
{
|
||||
if (s == null) { return new StringElement("Invalid Session"); }
|
||||
|
||||
Table container = new Table().setWidth("100%").setCellSpacing(10).setCellPadding(0).setBorder(0);
|
||||
|
||||
// CreateContent can generate error messages so you MUST call it before makeMessages()
|
||||
Element content = createContent(s);
|
||||
container.addElement(new TR().addElement(new TD().setColSpan(2).setVAlign("TOP").addElement(makeMessages(s))));
|
||||
container.addElement(new TR().addElement(new TD().setColSpan(2).addElement(content)));
|
||||
container.addElement(new TR());
|
||||
|
||||
return (container);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s)
|
||||
{
|
||||
System.out.println("errorscreen createContent Error:" + this.error + " message:" + this.message);
|
||||
|
||||
Element content;
|
||||
|
||||
if (this.error != null)
|
||||
{
|
||||
content = createContent(this.error);
|
||||
}
|
||||
else if (this.message != null)
|
||||
{
|
||||
content = createContent(this.message);
|
||||
}
|
||||
else
|
||||
{
|
||||
content = new StringElement("An unknown error occurred.");
|
||||
}
|
||||
|
||||
return content;
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(String s)
|
||||
{
|
||||
StringElement list = new StringElement(s);
|
||||
|
||||
return (list);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param t
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(Throwable t)
|
||||
{
|
||||
StringElement list = new StringElement();
|
||||
list.addElement(new H2().addElement(new StringElement("Error Message: " + t.getMessage())));
|
||||
list.addElement(formatStackTrace(t));
|
||||
|
||||
if (t instanceof ServletException)
|
||||
{
|
||||
Throwable root = ((ServletException) t).getRootCause();
|
||||
|
||||
if (root != null)
|
||||
{
|
||||
list.addElement(new H2().addElement(new StringElement("Root Message: " + root.getMessage())));
|
||||
list.addElement(formatStackTrace(root));
|
||||
}
|
||||
}
|
||||
|
||||
return (new Small().addElement(list));
|
||||
}
|
||||
|
||||
public Element getCredits()
|
||||
{
|
||||
return new ElementContainer();
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param t
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public static Element formatStackTrace(Throwable t)
|
||||
{
|
||||
String trace = getStackTrace(t);
|
||||
StringElement list = new StringElement();
|
||||
StringTokenizer st = new StringTokenizer(trace, "\r\n\t");
|
||||
|
||||
while (st.hasMoreTokens())
|
||||
{
|
||||
String line = st.nextToken();
|
||||
list.addElement(new Div(line));
|
||||
}
|
||||
|
||||
return (list);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the stackTrace attribute of the ErrorScreen class
|
||||
*
|
||||
* @param t
|
||||
* Description of the Parameter
|
||||
* @return The stackTrace value
|
||||
*/
|
||||
public static String getStackTrace(Throwable t)
|
||||
{
|
||||
ByteArrayOutputStream bytes = new ByteArrayOutputStream();
|
||||
PrintWriter writer = new PrintWriter(bytes, true);
|
||||
t.printStackTrace(writer);
|
||||
|
||||
return (bytes.toString());
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the ErrorScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("Error");
|
||||
}
|
||||
|
||||
public String getRole()
|
||||
{
|
||||
return AbstractLesson.USER_ROLE;
|
||||
}
|
||||
}
|
||||
63
src/main/java/org/owasp/webgoat/session/LessonSession.java
Normal file
63
src/main/java/org/owasp/webgoat/session/LessonSession.java
Normal file
@ -0,0 +1,63 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* Represents a virtual session for a lesson. Lesson-specific session data may be stored here.
|
||||
*
|
||||
* @author David Anderson <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
* @created January 19, 2006
|
||||
*/
|
||||
public class LessonSession
|
||||
{
|
||||
|
||||
private boolean isAuthenticated = false;
|
||||
|
||||
private String currentLessonScreen;
|
||||
|
||||
public void setAuthenticated(boolean isAuthenticated)
|
||||
{
|
||||
this.isAuthenticated = isAuthenticated;
|
||||
}
|
||||
|
||||
public boolean isAuthenticated()
|
||||
{
|
||||
return this.isAuthenticated;
|
||||
}
|
||||
|
||||
public void setCurrentLessonScreen(String currentLessonScreen)
|
||||
{
|
||||
this.currentLessonScreen = currentLessonScreen;
|
||||
}
|
||||
|
||||
public String getCurrentLessonScreen()
|
||||
{
|
||||
return this.currentLessonScreen;
|
||||
}
|
||||
|
||||
}
|
||||
404
src/main/java/org/owasp/webgoat/session/LessonTracker.java
Normal file
404
src/main/java/org/owasp/webgoat/session/LessonTracker.java
Normal file
@ -0,0 +1,404 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.io.FileInputStream;
|
||||
import java.io.FileNotFoundException;
|
||||
import java.io.FileOutputStream;
|
||||
import java.util.Properties;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created October 29, 2003
|
||||
*/
|
||||
public class LessonTracker
|
||||
{
|
||||
|
||||
private boolean completed = false;
|
||||
|
||||
private int maxHintLevel = 0;
|
||||
|
||||
private int numVisits = 0;
|
||||
|
||||
private boolean viewedCookies = false;
|
||||
|
||||
private boolean viewedHtml = false;
|
||||
|
||||
private boolean viewedLessonPlan = false;
|
||||
|
||||
private boolean viewedParameters = false;
|
||||
|
||||
private boolean viewedSource = false;
|
||||
|
||||
private boolean viewedSolution = false;
|
||||
|
||||
Properties lessonProperties = new Properties();
|
||||
|
||||
/**
|
||||
* Gets the completed attribute of the LessonTracker object
|
||||
*
|
||||
* @return The completed value
|
||||
*/
|
||||
public boolean getCompleted()
|
||||
{
|
||||
return completed;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the maxHintLevel attribute of the LessonTracker object
|
||||
*
|
||||
* @return The maxHintLevel value
|
||||
*/
|
||||
public int getMaxHintLevel()
|
||||
{
|
||||
return maxHintLevel;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the numVisits attribute of the LessonTracker object
|
||||
*
|
||||
* @return The numVisits value
|
||||
*/
|
||||
public int getNumVisits()
|
||||
{
|
||||
return numVisits;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the viewedCookies attribute of the LessonTracker object
|
||||
*
|
||||
* @return The viewedCookies value
|
||||
*/
|
||||
public boolean getViewedCookies()
|
||||
{
|
||||
return viewedCookies;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the viewedHtml attribute of the LessonTracker object
|
||||
*
|
||||
* @return The viewedHtml value
|
||||
*/
|
||||
public boolean getViewedHtml()
|
||||
{
|
||||
return viewedHtml;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the viewedLessonPlan attribute of the LessonTracker object
|
||||
*
|
||||
* @return The viewedLessonPlan value
|
||||
*/
|
||||
public boolean getViewedLessonPlan()
|
||||
{
|
||||
return viewedLessonPlan;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the viewedParameters attribute of the LessonTracker object
|
||||
*
|
||||
* @return The viewedParameters value
|
||||
*/
|
||||
public boolean getViewedParameters()
|
||||
{
|
||||
return viewedParameters;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the viewedSource attribute of the LessonTracker object
|
||||
*
|
||||
* @return The viewedSource value
|
||||
*/
|
||||
public boolean getViewedSource()
|
||||
{
|
||||
return viewedSource;
|
||||
}
|
||||
|
||||
public boolean getViewedSolution()
|
||||
{
|
||||
return viewedSource;
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*/
|
||||
public void incrementNumVisits()
|
||||
{
|
||||
numVisits++;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the properties attribute of the LessonTracker object
|
||||
*
|
||||
* @param props
|
||||
* The new properties value
|
||||
*/
|
||||
protected void setProperties(Properties props, Screen screen)
|
||||
{
|
||||
completed = Boolean.valueOf(props.getProperty(screen.getTitle() + ".completed")).booleanValue();
|
||||
maxHintLevel = Integer.parseInt(props.getProperty(screen.getTitle() + ".maxHintLevel", "0"));
|
||||
numVisits = Integer.parseInt(props.getProperty(screen.getTitle() + ".numVisits", "0"));
|
||||
viewedCookies = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedCookies", "false")).booleanValue();
|
||||
viewedHtml = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedHtml", "false")).booleanValue();
|
||||
viewedLessonPlan = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedLessonPlan", "false")).booleanValue();
|
||||
viewedParameters = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedParameters", "false")).booleanValue();
|
||||
viewedSource = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedSource", "false")).booleanValue();
|
||||
}
|
||||
|
||||
public static String getUserDir(WebSession s)
|
||||
{
|
||||
return s.getContext().getRealPath("users") + "/";
|
||||
}
|
||||
|
||||
private static String getTrackerFile(WebSession s, String user, Screen screen)
|
||||
{
|
||||
return getUserDir(s) + user + "." + screen.getClass().getName() + ".props";
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param screen
|
||||
* Description of the Parameter
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public static LessonTracker load(WebSession s, String user, Screen screen)
|
||||
{
|
||||
FileInputStream in = null;
|
||||
try
|
||||
{
|
||||
String fileName = getTrackerFile(s, user, screen);
|
||||
if (fileName != null)
|
||||
{
|
||||
Properties tempProps = new Properties();
|
||||
// System.out.println("Loading lesson state from: " + fileName);
|
||||
in = new FileInputStream(fileName);
|
||||
tempProps.load(in);
|
||||
// allow the screen to use any custom properties it may have set
|
||||
LessonTracker tempLessonTracker = screen.createLessonTracker(tempProps);
|
||||
tempLessonTracker.setProperties(tempProps, screen);
|
||||
return tempLessonTracker;
|
||||
}
|
||||
} catch (FileNotFoundException e)
|
||||
{
|
||||
// Normal if the lesson has not been accessed yet.
|
||||
} catch (Exception e)
|
||||
{
|
||||
System.out.println("Failed to load lesson state for " + screen);
|
||||
e.printStackTrace();
|
||||
} finally
|
||||
{
|
||||
try
|
||||
{
|
||||
in.close();
|
||||
} catch (Exception e)
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
return screen.createLessonTracker();
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the completed attribute of the LessonTracker object
|
||||
*
|
||||
* @param completed
|
||||
* The new completed value
|
||||
*/
|
||||
public void setCompleted(boolean completed)
|
||||
{
|
||||
this.completed = completed;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the maxHintLevel attribute of the LessonTracker object
|
||||
*
|
||||
* @param maxHintLevel
|
||||
* The new maxHintLevel value
|
||||
*/
|
||||
public void setMaxHintLevel(int maxHintLevel)
|
||||
{
|
||||
this.maxHintLevel = Math.max(this.maxHintLevel, maxHintLevel);
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the viewedCookies attribute of the LessonTracker object
|
||||
*
|
||||
* @param viewedCookies
|
||||
* The new viewedCookies value
|
||||
*/
|
||||
public void setViewedCookies(boolean viewedCookies)
|
||||
{
|
||||
this.viewedCookies = viewedCookies;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the viewedHtml attribute of the LessonTracker object
|
||||
*
|
||||
* @param viewedHtml
|
||||
* The new viewedHtml value
|
||||
*/
|
||||
public void setViewedHtml(boolean viewedHtml)
|
||||
{
|
||||
this.viewedHtml = viewedHtml;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the viewedLessonPlan attribute of the LessonTracker object
|
||||
*
|
||||
* @param viewedLessonPlan
|
||||
* The new viewedLessonPlan value
|
||||
*/
|
||||
public void setViewedLessonPlan(boolean viewedLessonPlan)
|
||||
{
|
||||
this.viewedLessonPlan = viewedLessonPlan;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the viewedParameters attribute of the LessonTracker object
|
||||
*
|
||||
* @param viewedParameters
|
||||
* The new viewedParameters value
|
||||
*/
|
||||
public void setViewedParameters(boolean viewedParameters)
|
||||
{
|
||||
this.viewedParameters = viewedParameters;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the viewedSource attribute of the LessonTracker object
|
||||
*
|
||||
* @param viewedSource
|
||||
* The new viewedSource value
|
||||
*/
|
||||
public void setViewedSource(boolean viewedSource)
|
||||
{
|
||||
this.viewedSource = viewedSource;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the viewedSource attribute of the LessonTracker object
|
||||
*
|
||||
* @param viewedSource
|
||||
* The new viewedSource value
|
||||
*/
|
||||
public void setViewedSolution(boolean viewedSolution)
|
||||
{
|
||||
this.viewedSolution = viewedSolution;
|
||||
}
|
||||
|
||||
/**
|
||||
* Allows the storing of properties for the logged in and a screen.
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
*/
|
||||
public void store(WebSession s, Screen screen)
|
||||
{
|
||||
store(s, screen, s.getUserName());
|
||||
}
|
||||
|
||||
/**
|
||||
* Allows the storing of properties for a user and a screen.
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
*/
|
||||
public void store(WebSession s, Screen screen, String user)
|
||||
{
|
||||
FileOutputStream out = null;
|
||||
String fileName = getTrackerFile(s, user, screen);
|
||||
// System.out.println( "Storing data to" + fileName );
|
||||
lessonProperties.setProperty(screen.getTitle() + ".completed", Boolean.toString(completed));
|
||||
lessonProperties.setProperty(screen.getTitle() + ".maxHintLevel", Integer.toString(maxHintLevel));
|
||||
lessonProperties.setProperty(screen.getTitle() + ".numVisits", Integer.toString(numVisits));
|
||||
lessonProperties.setProperty(screen.getTitle() + ".viewedCookies", Boolean.toString(viewedCookies));
|
||||
lessonProperties.setProperty(screen.getTitle() + ".viewedHtml", Boolean.toString(viewedHtml));
|
||||
lessonProperties.setProperty(screen.getTitle() + ".viewedLessonPlan", Boolean.toString(viewedLessonPlan));
|
||||
lessonProperties.setProperty(screen.getTitle() + ".viewedParameters", Boolean.toString(viewedParameters));
|
||||
lessonProperties.setProperty(screen.getTitle() + ".viewedSource", Boolean.toString(viewedSource));
|
||||
try
|
||||
{
|
||||
out = new FileOutputStream(fileName);
|
||||
lessonProperties.store(out, s.getUserName());
|
||||
} catch (Exception e)
|
||||
{
|
||||
// what do we want to do, I think nothing.
|
||||
System.out.println("Warning User data for " + s.getUserName() + " will not persist");
|
||||
} finally
|
||||
{
|
||||
try
|
||||
{
|
||||
out.close();
|
||||
} catch (Exception e)
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public String toString()
|
||||
{
|
||||
StringBuffer buff = new StringBuffer();
|
||||
buff.append("LessonTracker:" + "\n");
|
||||
buff.append(" - completed:.......... " + completed + "\n");
|
||||
buff.append(" - maxHintLevel:....... " + maxHintLevel + "\n");
|
||||
buff.append(" - numVisits:.......... " + numVisits + "\n");
|
||||
buff.append(" - viewedCookies:...... " + viewedCookies + "\n");
|
||||
buff.append(" - viewedHtml:......... " + viewedHtml + "\n");
|
||||
buff.append(" - viewedLessonPlan:... " + viewedLessonPlan + "\n");
|
||||
buff.append(" - viewedParameters:... " + viewedParameters + "\n");
|
||||
buff.append(" - viewedSource:....... " + viewedSource + "\n" + "\n");
|
||||
return buff.toString();
|
||||
}
|
||||
|
||||
/**
|
||||
* @return Returns the lessonProperties.
|
||||
*/
|
||||
public Properties getLessonProperties()
|
||||
{
|
||||
return lessonProperties;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param lessonProperties
|
||||
* The lessonProperties to set.
|
||||
*/
|
||||
public void setLessonProperties(Properties lessonProperties)
|
||||
{
|
||||
this.lessonProperties = lessonProperties;
|
||||
}
|
||||
}
|
||||
81
src/main/java/org/owasp/webgoat/session/Parameter.java
Normal file
81
src/main/java/org/owasp/webgoat/session/Parameter.java
Normal file
@ -0,0 +1,81 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class Parameter implements Comparable
|
||||
{
|
||||
|
||||
String name;
|
||||
|
||||
String value;
|
||||
|
||||
public Parameter(String name, String value)
|
||||
{
|
||||
this.name = name;
|
||||
this.value = value;
|
||||
}
|
||||
|
||||
public String getName()
|
||||
{
|
||||
return name;
|
||||
}
|
||||
|
||||
public String getValue()
|
||||
{
|
||||
return value;
|
||||
}
|
||||
|
||||
// @Override
|
||||
public boolean equals(Object obj)
|
||||
{
|
||||
if (obj instanceof Parameter)
|
||||
{
|
||||
Parameter other = (Parameter) obj;
|
||||
return (name.equals(other.getName()) && value.equals(other.getValue()));
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
// @Override
|
||||
public int hashCode()
|
||||
{
|
||||
return toString().hashCode();
|
||||
}
|
||||
|
||||
// @Override
|
||||
public String toString()
|
||||
{
|
||||
return (name + "=" + value);
|
||||
}
|
||||
|
||||
public int compareTo(Object o)
|
||||
{
|
||||
return toString().compareTo(o.toString());
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,59 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
*/
|
||||
public class ParameterNotFoundException extends Exception
|
||||
{
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
private static final long serialVersionUID = 3286112913299408382L;
|
||||
|
||||
/**
|
||||
* Constructs a new ParameterNotFoundException with no detail message.
|
||||
*/
|
||||
public ParameterNotFoundException()
|
||||
{
|
||||
super();
|
||||
}
|
||||
|
||||
/**
|
||||
* Constructs a new ParameterNotFoundException with the specified detail message.
|
||||
*
|
||||
* @param s
|
||||
* the detail message
|
||||
*/
|
||||
public ParameterNotFoundException(String s)
|
||||
{
|
||||
super(s);
|
||||
}
|
||||
}
|
||||
872
src/main/java/org/owasp/webgoat/session/ParameterParser.java
Normal file
872
src/main/java/org/owasp/webgoat/session/ParameterParser.java
Normal file
@ -0,0 +1,872 @@
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.util.Enumeration;
|
||||
import java.util.StringTokenizer;
|
||||
import java.util.Vector;
|
||||
import java.util.regex.Pattern;
|
||||
import javax.servlet.ServletRequest;
|
||||
import org.owasp.webgoat.util.HtmlEncoder;
|
||||
|
||||
/**
|
||||
* *************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect
|
||||
* Security</a>
|
||||
*/
|
||||
public class ParameterParser {
|
||||
|
||||
private final static String ALLOWED_CHARACTERS = "_$()-?.@!,:;=//+"; // Don't
|
||||
// allow
|
||||
// #&
|
||||
// specifically
|
||||
|
||||
private ServletRequest request;
|
||||
|
||||
/**
|
||||
* Constructs a new ParameterParser to handle the parameters of the given
|
||||
* request.
|
||||
*
|
||||
* @param request the servlet request
|
||||
*/
|
||||
public ParameterParser(ServletRequest request) {
|
||||
this.request = request;
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
private String clean(String s) {
|
||||
StringBuffer clean = new StringBuffer();
|
||||
|
||||
for (int loop = 0; loop < s.length(); loop++) {
|
||||
char c = s.charAt(loop);
|
||||
|
||||
if (Character.isLetterOrDigit(c) || Character.isWhitespace(c) || (ALLOWED_CHARACTERS.indexOf(c) != -1)) {
|
||||
clean.append(c);
|
||||
} else {
|
||||
clean.append('.');
|
||||
}
|
||||
}
|
||||
|
||||
return (clean.toString());
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a boolean
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @return the parameter value as a boolean
|
||||
* @exception ParameterNotFoundException if the parameter was not found
|
||||
*/
|
||||
public boolean getBooleanParameter(String name) throws ParameterNotFoundException {
|
||||
return new Boolean(getStringParameter(name)).booleanValue();
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a boolean, with a default. Returns the
|
||||
* default value if the parameter is not found.
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @param def the default parameter value
|
||||
* @return the parameter value as a boolean, or the default
|
||||
*/
|
||||
public boolean getBooleanParameter(String name, boolean def) {
|
||||
try {
|
||||
return getBooleanParameter(name);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the booleanSubParameter attribute of the ParameterParser object
|
||||
*
|
||||
* @param first Description of the Parameter
|
||||
* @param next Description of the Parameter
|
||||
* @param def Description of the Parameter
|
||||
* @return The booleanSubParameter value
|
||||
*/
|
||||
public boolean getBooleanSubParameter(String first, String next, boolean def) {
|
||||
try {
|
||||
return new Boolean(getSubParameter(first, next)).booleanValue();
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a byte
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @return the parameter value as a byte
|
||||
* @exception ParameterNotFoundException if the parameter was not found
|
||||
* @exception NumberFormatException if the parameter value could not be
|
||||
* converted to a byte
|
||||
*/
|
||||
public byte getByteParameter(String name) throws ParameterNotFoundException, NumberFormatException {
|
||||
return Byte.parseByte(getStringParameter(name));
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a byte, with a default. Returns the
|
||||
* default value if the parameter is not found or cannot be converted to a
|
||||
* byte.
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @param def the default parameter value
|
||||
* @return the parameter value as a byte, or the default
|
||||
*/
|
||||
public byte getByteParameter(String name, byte def) {
|
||||
try {
|
||||
return getByteParameter(name);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a char
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @return the parameter value as a char
|
||||
* @exception ParameterNotFoundException if the parameter was not found or
|
||||
* was the empty string
|
||||
*/
|
||||
public char getCharParameter(String name) throws ParameterNotFoundException {
|
||||
String param = getStringParameter(name);
|
||||
|
||||
if (param.length() == 0) {
|
||||
throw new ParameterNotFoundException(name + " is empty string");
|
||||
} else {
|
||||
return (param.charAt(0));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a char, with a default. Returns the
|
||||
* default value if the parameter is not found.
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @param def the default parameter value
|
||||
* @return the parameter value as a char, or the default
|
||||
*/
|
||||
public char getCharParameter(String name, char def) {
|
||||
try {
|
||||
return getCharParameter(name);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the classNameParameter attribute of the ParameterParser object
|
||||
*
|
||||
* @param name Description of the Parameter
|
||||
* @return The classNameParameter value
|
||||
*/
|
||||
public String getClassNameParameter(String name) throws ParameterNotFoundException {
|
||||
String p = getStringParameter(name);
|
||||
StringTokenizer st = new StringTokenizer(p);
|
||||
|
||||
return (st.nextToken().trim());
|
||||
}
|
||||
|
||||
// FIXME: check for [a-zA-Z].([a-zA-Z])*
|
||||
/**
|
||||
* Gets the classNameParameter attribute of the ParameterParser object
|
||||
*
|
||||
* @param name Description of the Parameter
|
||||
* @param def Description of the Parameter
|
||||
* @return The classNameParameter value
|
||||
*/
|
||||
public String getClassNameParameter(String name, String def) {
|
||||
try {
|
||||
return getClassNameParameter(name);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a double
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @return the parameter value as a double
|
||||
* @exception ParameterNotFoundException if the parameter was not found
|
||||
* @exception NumberFormatException if the parameter could not be converted
|
||||
* to a double
|
||||
*/
|
||||
public double getDoubleParameter(String name) throws ParameterNotFoundException, NumberFormatException {
|
||||
return new Double(getStringParameter(name)).doubleValue();
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a double, with a default. Returns the
|
||||
* default value if the parameter is not found.
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @param def the default parameter value
|
||||
* @return the parameter value as a double, or the default
|
||||
*/
|
||||
public double getDoubleParameter(String name, double def) {
|
||||
try {
|
||||
return getDoubleParameter(name);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a float
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @return the parameter value as a float
|
||||
* @exception ParameterNotFoundException if the parameter was not found
|
||||
* @exception NumberFormatException if the parameter could not be converted
|
||||
* to a float
|
||||
*/
|
||||
public float getFloatParameter(String name) throws ParameterNotFoundException, NumberFormatException {
|
||||
return new Float(getStringParameter(name)).floatValue();
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a float, with a default. Returns the
|
||||
* default value if the parameter is not found.
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @param def the default parameter value
|
||||
* @return the parameter value as a float, or the default
|
||||
*/
|
||||
public float getFloatParameter(String name, float def) {
|
||||
try {
|
||||
return getFloatParameter(name);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as an IP String, with a default. Returns
|
||||
* the default value if the parameter is not found or is the empty string.
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @param def the default parameter value
|
||||
* @return the parameter value as a String, or the default
|
||||
*/
|
||||
public String getIPParameter(String name, String def) {
|
||||
try {
|
||||
return getIPParameter(name);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as an IP String
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @return the parameter value as a valid IP String or an Empty string if
|
||||
* invalid
|
||||
* @exception ParameterNotFoundException if the parameter was not found or
|
||||
* was the empty string
|
||||
*/
|
||||
public String getIPParameter(String name) throws ParameterNotFoundException {
|
||||
boolean valid = true;
|
||||
String[] values = request.getParameterValues(name);
|
||||
String value;
|
||||
|
||||
if (values == null) {
|
||||
throw new ParameterNotFoundException(name + " not found");
|
||||
} else if (values[0].length() == 0) {
|
||||
throw new ParameterNotFoundException(name + " was empty");
|
||||
} else {
|
||||
// trim illegal characters
|
||||
value = clean(values[0].trim());
|
||||
|
||||
if (value.indexOf("&") > 0) {
|
||||
// truncate additional parameters that follow &
|
||||
value = value.substring(0, value.indexOf("&"));
|
||||
}
|
||||
|
||||
// validate the IP ex: 124.143.12.254
|
||||
int startIndex = 0;
|
||||
int endIndex = 0;
|
||||
int octetCount = 0;
|
||||
int octetValue;
|
||||
String octet;
|
||||
|
||||
// if no .'s then it's not an IP
|
||||
if (value.indexOf(".") >= 0) {
|
||||
while ((valid == true) && (octetCount < 4)) {
|
||||
endIndex = value.indexOf(".", startIndex);
|
||||
|
||||
if (endIndex == -1) {
|
||||
endIndex = value.length();
|
||||
}
|
||||
|
||||
octet = value.substring(startIndex, endIndex);
|
||||
startIndex = endIndex + 1;
|
||||
|
||||
try {
|
||||
octetValue = Integer.parseInt(octet);
|
||||
|
||||
if ((octetValue <= 0) || (octetValue >= 256)) {
|
||||
valid = false;
|
||||
}
|
||||
} catch (Exception e) {
|
||||
valid = false;
|
||||
}
|
||||
|
||||
octetCount++;
|
||||
}
|
||||
} else {
|
||||
// Not a valid IP
|
||||
valid = false;
|
||||
}
|
||||
|
||||
// Check for any extra garbage. If the last octet was a large value
|
||||
// it would be trapped by the above range check.
|
||||
if (value.length() != endIndex) {
|
||||
valid = false;
|
||||
}
|
||||
|
||||
return valid ? value : null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a int
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @return the parameter value as a int
|
||||
* @exception ParameterNotFoundException if the parameter was not found
|
||||
* @exception NumberFormatException if the parameter could not be converted
|
||||
* to a int
|
||||
*/
|
||||
public int getIntParameter(String name) throws ParameterNotFoundException, NumberFormatException {
|
||||
return Integer.parseInt(getStringParameter(name));
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a int, with a default. Returns the
|
||||
* default value if the parameter is not found.
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @param def the default parameter value
|
||||
* @return the parameter value as a int, or the default
|
||||
*/
|
||||
public int getIntParameter(String name, int def) {
|
||||
try {
|
||||
return getIntParameter(name);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a long
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @return the parameter value as a long
|
||||
* @exception ParameterNotFoundException if the parameter was not found
|
||||
* @exception NumberFormatException if the parameter could not be converted
|
||||
* to a long
|
||||
*/
|
||||
public long getLongParameter(String name) throws ParameterNotFoundException, NumberFormatException {
|
||||
return Long.parseLong(getStringParameter(name));
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a long, with a default. Returns the
|
||||
* default value if the parameter is not found.
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @param def the default parameter value
|
||||
* @return the parameter value as a long, or the default
|
||||
*/
|
||||
public long getLongParameter(String name, long def) {
|
||||
try {
|
||||
return getLongParameter(name);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Determines which of the required parameters were missing from the
|
||||
* request. Returns null if all the parameters are present.
|
||||
*
|
||||
* @param requestuired Description of the Parameter
|
||||
* @return an array of missing parameters, or null if none are missing
|
||||
*/
|
||||
public String[] getMissingParameters(String[] requestuired) {
|
||||
Vector<String> missing = new Vector<String>();
|
||||
|
||||
for (int i = 0; i < requestuired.length; i++) {
|
||||
String val = getStringParameter(requestuired[i], null);
|
||||
|
||||
if (val == null) {
|
||||
missing.addElement(requestuired[i]);
|
||||
}
|
||||
}
|
||||
|
||||
if (missing.size() == 0) {
|
||||
return null;
|
||||
} else {
|
||||
String[] ret = new String[missing.size()];
|
||||
missing.copyInto(ret);
|
||||
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the parameterNames attribute of the ParameterParser object
|
||||
*
|
||||
* @return The parameterNames value
|
||||
*/
|
||||
public Enumeration getParameterNames() {
|
||||
if (request == null) {
|
||||
return (null);
|
||||
}
|
||||
|
||||
return request.getParameterNames();
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the parameterValues attribute of the ParameterParser object
|
||||
*
|
||||
* @param name Description of the Parameter
|
||||
* @return The parameterValues value
|
||||
*/
|
||||
public String[] getParameterValues(String name) {
|
||||
if (request == null) {
|
||||
return (null);
|
||||
}
|
||||
|
||||
return request.getParameterValues(name);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the rawParameter attribute of the ParameterParser object
|
||||
*
|
||||
* @param name Description of the Parameter
|
||||
* @param def Description of the Parameter
|
||||
* @return The rawParameter value
|
||||
*/
|
||||
public String getRawParameter(String name, String def) {
|
||||
try {
|
||||
return getRawParameter(name);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the rawParameter attribute of the ParameterParser object
|
||||
*
|
||||
* @param name Description of the Parameter
|
||||
* @return The rawParameter value
|
||||
* @exception ParameterNotFoundException Description of the Exception
|
||||
*/
|
||||
public String getRawParameter(String name) throws ParameterNotFoundException {
|
||||
String[] values = request.getParameterValues(name);
|
||||
|
||||
if (values == null) {
|
||||
throw new ParameterNotFoundException(name + " not found");
|
||||
} else if (values[0].length() == 0) {
|
||||
throw new ParameterNotFoundException(name + " was empty");
|
||||
}
|
||||
|
||||
return (values[0]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a short
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @return the parameter value as a short
|
||||
* @exception ParameterNotFoundException if the parameter was not found
|
||||
* @exception NumberFormatException if the parameter could not be converted
|
||||
* to a short
|
||||
*/
|
||||
public short getShortParameter(String name) throws ParameterNotFoundException, NumberFormatException {
|
||||
return Short.parseShort(getStringParameter(name));
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a short, with a default. Returns the
|
||||
* default value if the parameter is not found.
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @param def the default parameter value
|
||||
* @return the parameter value as a short, or the default
|
||||
*/
|
||||
public short getShortParameter(String name, short def) {
|
||||
try {
|
||||
return getShortParameter(name);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a String
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @return the parameter value as a String
|
||||
* @exception ParameterNotFoundException if the parameter was not found or
|
||||
* was the empty string
|
||||
*/
|
||||
public String getStringParameter(String name) throws ParameterNotFoundException {
|
||||
String[] values = request.getParameterValues(name);
|
||||
String value;
|
||||
|
||||
if (values == null) {
|
||||
throw new ParameterNotFoundException(name + " not found");
|
||||
} else if (values[0].length() == 0) {
|
||||
throw new ParameterNotFoundException(name + " was empty");
|
||||
} else {
|
||||
// trim illegal characters
|
||||
value = clean(values[0].trim());
|
||||
|
||||
if (value.indexOf("&") > 0) {
|
||||
// truncate additional parameters that follow &
|
||||
value = value.substring(0, value.indexOf("&"));
|
||||
}
|
||||
|
||||
return value;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the named parameter value as a String, with a default. Returns the
|
||||
* default value if the parameter is not found or is the empty string.
|
||||
*
|
||||
* @param name the parameter name
|
||||
* @param def the default parameter value
|
||||
* @return the parameter value as a String, or the default
|
||||
*/
|
||||
public String getStringParameter(String name, String def) {
|
||||
try {
|
||||
return getStringParameter(name);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the subParameter attribute of the ParameterParser object
|
||||
*
|
||||
* @param first Description of the Parameter
|
||||
* @param next Description of the Parameter
|
||||
* @param def Description of the Parameter
|
||||
* @return The subParameter value
|
||||
*/
|
||||
public String getSubParameter(String first, String next, String def) {
|
||||
try {
|
||||
return getSubParameter(first, next);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the parameter named 'next' following the parameter 'first'. Presumes
|
||||
* the structure: first=firstvalue&next=nextValue
|
||||
*
|
||||
* @param first Description of the Parameter
|
||||
* @param next Description of the Parameter
|
||||
* @return The subParameter value
|
||||
* @exception ParameterNotFoundException Description of the Exception
|
||||
*/
|
||||
public String getSubParameter(String first, String next) throws ParameterNotFoundException {
|
||||
String[] values = request.getParameterValues(first);
|
||||
String value;
|
||||
|
||||
if (values == null) {
|
||||
throw new ParameterNotFoundException(first + " not found");
|
||||
} else if (values[0].length() == 0) {
|
||||
throw new ParameterNotFoundException(first + " was empty");
|
||||
} else {
|
||||
value = clean(values[0].trim());
|
||||
|
||||
int idx = value.indexOf("&") + 1;
|
||||
|
||||
// index of first char of first sub-param name
|
||||
if (idx == 0) {
|
||||
throw new ParameterNotFoundException("No subparameter key");
|
||||
}
|
||||
|
||||
value = value.substring(idx);
|
||||
|
||||
// System.out.println("= = = = = =Parameter parser looking for " +
|
||||
// next + " in " + value );
|
||||
int nextValueIndex = value.indexOf(next + "=");
|
||||
|
||||
// System.out.println("= = = = = =Parameter parser nextValueIndex =
|
||||
// " + nextValueIndex );
|
||||
if (nextValueIndex < 0) {
|
||||
throw new ParameterNotFoundException("No subparameter value");
|
||||
}
|
||||
|
||||
nextValueIndex += (next.length() + 1);
|
||||
|
||||
if (nextValueIndex >= 0) {
|
||||
value = value.substring(nextValueIndex);
|
||||
} else {
|
||||
throw new ParameterNotFoundException(next + " not found");
|
||||
}
|
||||
}
|
||||
|
||||
if (value.indexOf("&") > 0) {
|
||||
// truncate additional parameters that follow &
|
||||
value = value.substring(0, value.indexOf("&"));
|
||||
}
|
||||
|
||||
// System.out.println("=-=-=-=-=ParameterParser returning value " +
|
||||
// value );
|
||||
return value;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the wordParameter attribute of the ParameterParser object
|
||||
*
|
||||
* @param name Description of the Parameter
|
||||
* @return The wordParameter value
|
||||
*/
|
||||
public String getWordParameter(String name) throws ParameterNotFoundException {
|
||||
String p = getStringParameter(name);
|
||||
StringTokenizer st = new StringTokenizer(p);
|
||||
|
||||
return (st.nextToken().trim());
|
||||
}
|
||||
|
||||
// FIXME: check for [a-zA-Z]
|
||||
/**
|
||||
* Gets the wordParameter attribute of the ParameterParser object
|
||||
*
|
||||
* @param name Description of the Parameter
|
||||
* @param def Description of the Parameter
|
||||
* @return The wordParameter value
|
||||
*/
|
||||
public String getWordParameter(String name, String def) {
|
||||
try {
|
||||
return getWordParameter(name);
|
||||
} catch (Exception e) {
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the specified parameter from the request and validates it against
|
||||
* the provided regular expression. If the regular expression check fails,
|
||||
* the default value is returned instead.
|
||||
*
|
||||
* @param name The name of the parameter to retrieve from the request.
|
||||
* @param def The default value of the parameter.
|
||||
* @param regexpattern The precompiled regular expression to be used to
|
||||
* validate the parameter.
|
||||
* @return The validated parameter value, or the default value if validation
|
||||
* failed.
|
||||
*/
|
||||
private String getRegexParameter(String name, String def, Pattern regexpattern) throws ValidationException {
|
||||
try {
|
||||
return getRegexParameter(name, regexpattern);
|
||||
} catch (Exception e) {
|
||||
// System.out.println("Exception occured in defined pattern match");
|
||||
// e.printStackTrace();
|
||||
return def;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the specified parameter from the request and validates it against
|
||||
* the provided regular expression. If the regular expression check fails,
|
||||
* the default value is returned instead.
|
||||
*
|
||||
* @param name The name of the parameter to retrieve from the request.
|
||||
* @param def The default value of the parameter.
|
||||
* @param regexpattern The precompiled regular expression to be used to
|
||||
* validate the parameter.
|
||||
* @return The validated parameter value, or the default value if validation
|
||||
* failed.
|
||||
*/
|
||||
private String getRegexParameter(String name, Pattern regexpattern) throws ParameterNotFoundException,
|
||||
ValidationException {
|
||||
String param = getStringParameter(name);
|
||||
|
||||
if (regexpattern.matcher(param).matches()) {
|
||||
return param;
|
||||
} else {
|
||||
// System.out.println(param + " didn't match defined pattern.");
|
||||
throw new ValidationException(name + " contained an invalid value");
|
||||
}
|
||||
}
|
||||
|
||||
public String getStrictAlphaParameter(String name, int maxLength) throws ParameterNotFoundException,
|
||||
ValidationException {
|
||||
String alphaRegEx = "^[a-zA-Z\\s]{0," + maxLength + "}$";
|
||||
Pattern alphaPattern = Pattern.compile(alphaRegEx);
|
||||
|
||||
return getRegexParameter(name, alphaPattern);
|
||||
}
|
||||
|
||||
public String getStrictNumericParameter(String name, int maxLength) throws ParameterNotFoundException,
|
||||
ValidationException {
|
||||
String numericRegEx = "^\\d{0," + maxLength + "}$";
|
||||
Pattern numericPattern = Pattern.compile(numericRegEx);
|
||||
|
||||
return getRegexParameter(name, numericPattern);
|
||||
}
|
||||
|
||||
private static final String SSNREGEX = "^\\d{3}-\\d{2}-\\d{4}$";
|
||||
|
||||
private static final Pattern Ssnpattern = Pattern.compile(SSNREGEX);
|
||||
|
||||
public String getSsnParameter(String name) throws ParameterNotFoundException, ValidationException {
|
||||
return getRegexParameter(name, Ssnpattern);
|
||||
}
|
||||
|
||||
// Validates format for major brands of credit card.
|
||||
// private static final String CCNREGEX =
|
||||
// "^(?:(?<Visa>4\\d{3})|(?<Mastercard>5[1-5]\\d{2})|(?<Discover>6011)|(?<DinersClub>(?:3[68]\\d{2})|(?:30[0-5]\\d))|(?<AmericanExpress>3[47]\\d{2}))([
|
||||
//-]?)(?(DinersClub)(?:\\d{6}\\1\\d{4})|(?(AmericanExpress)(?:\\d{6}\\1\\d{5})|(?:\\d{4}\\1\\d{4
|
||||
// }\\1\\d{4})))$";
|
||||
private static final String CCNREGEX = "^\\d{16}$";
|
||||
|
||||
private static final Pattern Ccnpattern = Pattern.compile(CCNREGEX);
|
||||
|
||||
public String getCcnParameter(String name) throws ParameterNotFoundException, ValidationException {
|
||||
return getRegexParameter(name, Ccnpattern);
|
||||
}
|
||||
|
||||
private static final String ZIPREGEX = "^\\d{5}(-\\d{4})?$";
|
||||
|
||||
private static final Pattern Zippattern = Pattern.compile(ZIPREGEX);
|
||||
|
||||
public String getZipParameter(String name) throws ParameterNotFoundException, ValidationException {
|
||||
return getZipParameter(name, null);
|
||||
}
|
||||
|
||||
public String getZipParameter(String name, String def) throws ValidationException {
|
||||
return getRegexParameter(name, def, Zippattern);
|
||||
}
|
||||
|
||||
private static final String PHONEREGEX = "^\\(?[\\d]{3}\\)?[\\s-]?[\\d]{3}[\\s-]?[\\d]{4}$";
|
||||
|
||||
// Or this more forgiving pattern:
|
||||
// private static final String PHONEREGEX = "^([\\-()+ 0-9x])+$";
|
||||
private static final Pattern phonepattern = Pattern.compile(PHONEREGEX);
|
||||
|
||||
public String getPhoneParameter(String name) throws ParameterNotFoundException, ValidationException {
|
||||
return getPhoneParameter(name, null);
|
||||
}
|
||||
|
||||
public String getPhoneParameter(String name, String def) throws ValidationException {
|
||||
return getRegexParameter(name, def, phonepattern);
|
||||
}
|
||||
|
||||
private static final String EMAILREGEX = "^[\\w-]+(?:\\.[\\w-]+)*@(?:[\\w-]+\\.)+[a-zA-Z]{2,7}$";
|
||||
|
||||
private static final Pattern emailpattern = Pattern.compile(EMAILREGEX);
|
||||
|
||||
public String getEMailParameter(String name) throws ParameterNotFoundException, ValidationException {
|
||||
return getEMailParameter(name, null);
|
||||
}
|
||||
|
||||
public String getEMailParameter(String name, String def) throws ValidationException {
|
||||
return getRegexParameter(name, def, emailpattern);
|
||||
}
|
||||
|
||||
private static final String DATEREGEX = "([\\/ .,:0-9a-zA-Z])+$";
|
||||
|
||||
private static final Pattern datepattern = Pattern.compile(DATEREGEX);
|
||||
|
||||
public String getDateParameter(String name) throws ParameterNotFoundException, ValidationException {
|
||||
return getDateParameter(name, null);
|
||||
}
|
||||
|
||||
public String getDateParameter(String name, String def) throws ValidationException {
|
||||
return getRegexParameter(name, def, datepattern);
|
||||
}
|
||||
|
||||
private static final String URLREGEX = "^(((https?)://)([-()_.!~*';/?:@&=+$,A-Za-z0-9])+)([).!';/?:,][[:blank:]])?$";
|
||||
|
||||
private static final Pattern URLpattern = Pattern.compile(URLREGEX);
|
||||
|
||||
public String getURLParameter(String name) throws ParameterNotFoundException, ValidationException {
|
||||
return getURLParameter(name, null);
|
||||
}
|
||||
|
||||
public String getURLParameter(String name, String def) throws ValidationException {
|
||||
return getRegexParameter(name, def, URLpattern);
|
||||
}
|
||||
|
||||
protected static String htmlEncode(String s) {
|
||||
return HtmlEncoder.encode(s);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public String toString() {
|
||||
StringBuffer s = new StringBuffer("[");
|
||||
Enumeration e = getParameterNames();
|
||||
|
||||
while (e.hasMoreElements()) {
|
||||
String key = (String) e.nextElement();
|
||||
s.append(key + "=" + getParameterValues(key)[0]);
|
||||
|
||||
// FIXME: Other values?
|
||||
if (e.hasMoreElements()) {
|
||||
s.append(",");
|
||||
}
|
||||
}
|
||||
|
||||
s.append("]");
|
||||
|
||||
return (s.toString());
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param request Description of the Parameter
|
||||
*/
|
||||
public void update(ServletRequest request) {
|
||||
this.request = request;
|
||||
}
|
||||
}
|
||||
117
src/main/java/org/owasp/webgoat/session/RandomLessonTracker.java
Normal file
117
src/main/java/org/owasp/webgoat/session/RandomLessonTracker.java
Normal file
@ -0,0 +1,117 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
import java.util.Properties;
|
||||
|
||||
|
||||
public class RandomLessonTracker extends LessonTracker
|
||||
{
|
||||
|
||||
private String[] stages;
|
||||
|
||||
private String stage;
|
||||
|
||||
private Map<String, Boolean> completed = new HashMap<String, Boolean>();
|
||||
|
||||
public RandomLessonTracker(String[] stages)
|
||||
{
|
||||
if (stages == null) stages = new String[0];
|
||||
this.stages = stages;
|
||||
}
|
||||
|
||||
public void setStage(String stage)
|
||||
{
|
||||
this.stage = stage;
|
||||
}
|
||||
|
||||
public String getStage()
|
||||
{
|
||||
if (this.stage == null && stages.length > 0) return stages[0];
|
||||
return this.stage;
|
||||
}
|
||||
|
||||
public void setStageComplete(String stage, boolean complete)
|
||||
{
|
||||
completed.put(stage, Boolean.valueOf(complete));
|
||||
if (!complete) return;
|
||||
int i = getStageNumber(stage);
|
||||
if (i < stages.length - 1) setStage(stages[i + 1]);
|
||||
}
|
||||
|
||||
public int getStageNumber(String stage)
|
||||
{
|
||||
for (int i = 0; i < stages.length; i++)
|
||||
if (stages[i].equals(stage)) return i;
|
||||
return -1;
|
||||
}
|
||||
|
||||
public boolean hasCompleted(String stage)
|
||||
{
|
||||
Boolean complete = completed.get(stage);
|
||||
return complete == null ? false : complete.booleanValue();
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean getCompleted()
|
||||
{
|
||||
for (int i = 0; i < stages.length; i++)
|
||||
if (!hasCompleted(stages[i])) return false;
|
||||
return true;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void setCompleted(boolean complete)
|
||||
{
|
||||
if (complete == true) throw new UnsupportedOperationException("Use individual stage completion instead");
|
||||
for (int i = 0; i < stages.length; i++)
|
||||
setStageComplete(stages[i], false);
|
||||
setStage(stages[0]);
|
||||
}
|
||||
|
||||
protected void setProperties(Properties props, Screen screen)
|
||||
{
|
||||
super.setProperties(props, screen);
|
||||
for (int i = 0; i < stages.length; i++)
|
||||
{
|
||||
String p = props.getProperty(screen.getTitle() + "." + stages[i] + ".completed");
|
||||
if (p != null)
|
||||
{
|
||||
setStageComplete(stages[i], Boolean.valueOf(p));
|
||||
}
|
||||
}
|
||||
setStage(props.getProperty(screen.getTitle() + ".stage"));
|
||||
}
|
||||
|
||||
public void store(WebSession s, Screen screen, String user)
|
||||
{
|
||||
for (int i = 0; i < stages.length; i++)
|
||||
{
|
||||
if (hasCompleted(stages[i]))
|
||||
{
|
||||
lessonProperties.setProperty(screen.getTitle() + "." + stages[i] + ".completed", Boolean.TRUE
|
||||
.toString());
|
||||
}
|
||||
else
|
||||
{
|
||||
lessonProperties.remove(screen.getTitle() + "." + stages[i] + ".completed");
|
||||
}
|
||||
}
|
||||
lessonProperties.setProperty(screen.getTitle() + ".stage", getStage());
|
||||
super.store(s, screen, user);
|
||||
}
|
||||
|
||||
public String toString()
|
||||
{
|
||||
StringBuffer buff = new StringBuffer();
|
||||
buff.append(super.toString());
|
||||
for (int i = 0; i < stages.length; i++)
|
||||
{
|
||||
buff.append(" - completed " + stages[i] + " :....... " + hasCompleted(stages[i]) + "\n");
|
||||
}
|
||||
buff.append(" - currentStage:....... " + getStage() + "\n");
|
||||
return buff.toString();
|
||||
}
|
||||
|
||||
}
|
||||
284
src/main/java/org/owasp/webgoat/session/Screen.java
Normal file
284
src/main/java/org/owasp/webgoat/session/Screen.java
Normal file
@ -0,0 +1,284 @@
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.io.PrintWriter;
|
||||
import java.util.Properties;
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.HtmlColor;
|
||||
import org.apache.ecs.StringElement;
|
||||
import org.apache.ecs.html.A;
|
||||
import org.apache.ecs.html.Font;
|
||||
import org.apache.ecs.html.IMG;
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
|
||||
/**
|
||||
* *************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect
|
||||
* Security</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public abstract class Screen {
|
||||
|
||||
/**
|
||||
* Description of the Field
|
||||
*/
|
||||
public static int MAIN_SIZE = 375;
|
||||
|
||||
// private Head head;
|
||||
private Element content;
|
||||
|
||||
final static IMG logo = new IMG("images/aspectlogo-horizontal-small.jpg").setAlt("Aspect Security").setBorder(0)
|
||||
.setHspace(0).setVspace(0);
|
||||
|
||||
/**
|
||||
* Constructor for the Screen object
|
||||
*/
|
||||
public Screen() {
|
||||
}
|
||||
|
||||
// FIXME: Each lesson should have a role assigned to it. Each user/student
|
||||
// should also have a role(s) assigned. The user would only be allowed
|
||||
// to see lessons that correspond to their role. Eventually these roles
|
||||
// will be stored in the internal database. The user will be able to hack
|
||||
// into the database and change their role. This will allow the user to
|
||||
// see the admin screens, once they figure out how to turn the admin switch on.
|
||||
public abstract String getRole();
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected abstract Element createContent(WebSession s);
|
||||
|
||||
/**
|
||||
* Gets the credits attribute of the Screen object
|
||||
*
|
||||
* @return The credits value
|
||||
*/
|
||||
public abstract Element getCredits();
|
||||
|
||||
/**
|
||||
* Creates a new lessonTracker object.
|
||||
*
|
||||
* @param props The properties file that was used to persist the user data.
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public LessonTracker createLessonTracker(Properties props) {
|
||||
|
||||
// If the lesson had any specialized properties in the user persisted properties,
|
||||
// now would be the time to pull them out.
|
||||
return createLessonTracker();
|
||||
}
|
||||
|
||||
/**
|
||||
* This allows the screens to provide a custom LessonTracker object if
|
||||
* needed.
|
||||
*
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public LessonTracker createLessonTracker() {
|
||||
return new LessonTracker();
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the lessonTracker attribute of the AbstractLesson object
|
||||
*
|
||||
* @param userName Description of the Parameter
|
||||
* @return The lessonTracker value
|
||||
*/
|
||||
public LessonTracker getLessonTracker(WebSession s) {
|
||||
UserTracker userTracker = UserTracker.instance();
|
||||
return userTracker.getLessonTracker(s, this);
|
||||
}
|
||||
|
||||
public LessonTracker getLessonTracker(WebSession s, String userNameOverride) {
|
||||
UserTracker userTracker = UserTracker.instance();
|
||||
return userTracker.getLessonTracker(s, userNameOverride, this);
|
||||
}
|
||||
|
||||
public LessonTracker getLessonTracker(WebSession s, AbstractLesson lesson) {
|
||||
UserTracker userTracker = UserTracker.instance();
|
||||
return userTracker.getLessonTracker(s, lesson);
|
||||
}
|
||||
|
||||
/**
|
||||
* Fill in a descriptive title for this lesson
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public abstract String getTitle();
|
||||
|
||||
protected void setContent(Element content) {
|
||||
this.content = content;
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element makeLogo() {
|
||||
|
||||
return new A("http://www.aspectsecurity.com/webgoat.html", logo);
|
||||
}
|
||||
|
||||
public String getSponsor() {
|
||||
return "Aspect Security";
|
||||
}
|
||||
|
||||
public String getSponsorLogoResource() {
|
||||
return "images/aspectlogo-horizontal-small.jpg";
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element makeMessages(WebSession s) {
|
||||
|
||||
if (s == null) {
|
||||
|
||||
return (new StringElement(""));
|
||||
}
|
||||
|
||||
Font f = new Font().setColor(HtmlColor.RED);
|
||||
|
||||
String message = s.getMessage();
|
||||
|
||||
f.addElement(message);
|
||||
|
||||
return (f);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the content length of the the html.
|
||||
*
|
||||
*/
|
||||
public int getContentLength() {
|
||||
return getContent().length();
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param out Description of the Parameter
|
||||
*/
|
||||
public void output(PrintWriter out) {
|
||||
|
||||
// format output -- then send to printwriter
|
||||
// otherwise we're doing way too much SSL encryption work
|
||||
out.print(getContent());
|
||||
|
||||
}
|
||||
|
||||
// TODO we could hook all forms here with javascript call to ajax forms plugin
|
||||
public String getContent() {
|
||||
String makeFormsAjax = "<script> $(document).ready(function() { makeFormsAjax(); });</script>";
|
||||
// handle this on the page with js
|
||||
makeFormsAjax = "";
|
||||
return (content == null) ? "" : content.toString() + makeFormsAjax;
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param x Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected static String pad(int x) {
|
||||
|
||||
StringBuilder sb = new StringBuilder();
|
||||
|
||||
if (x < 10) {
|
||||
|
||||
sb.append(" ");
|
||||
|
||||
}
|
||||
|
||||
if (x < 100) {
|
||||
|
||||
sb.append(" ");
|
||||
|
||||
}
|
||||
|
||||
sb.append(x);
|
||||
|
||||
return (sb.toString());
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param token Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected static String convertMetachars(String token) {
|
||||
|
||||
int mci = 0;
|
||||
|
||||
/*
|
||||
* meta char array FIXME: Removed the conversion of whitespace " " to " " in order for
|
||||
* the html to be automatically wrapped in client browser. It is better to add line length
|
||||
* checking and only do " " conversion in lines that won't exceed screen size, say less
|
||||
* than 80 characters.
|
||||
*/
|
||||
String[] metaChar = {"&", "<", ">", "\"", "\t", System.getProperty("line.separator")};
|
||||
|
||||
String[] htmlCode = {"&", "<", ">", """, " ", "<br>"};
|
||||
|
||||
String replacedString = token;
|
||||
for (; mci < metaChar.length; mci += 1) {
|
||||
replacedString = replacedString.replaceAll(metaChar[mci], htmlCode[mci]);
|
||||
}
|
||||
return (replacedString);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param token Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected static String convertMetacharsJavaCode(String token) {
|
||||
return (convertMetachars(token).replaceAll(" ", " "));
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
// protected abstract Element wrapForm( WebSession s );
|
||||
}
|
||||
@ -0,0 +1,38 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.util.Properties;
|
||||
|
||||
|
||||
public class SequentialLessonTracker extends LessonTracker
|
||||
{
|
||||
|
||||
private int currentStage = 1;
|
||||
|
||||
public int getStage()
|
||||
{
|
||||
return currentStage;
|
||||
}
|
||||
|
||||
public void setStage(int stage)
|
||||
{
|
||||
currentStage = stage;
|
||||
}
|
||||
|
||||
protected void setProperties(Properties props, Screen screen)
|
||||
{
|
||||
super.setProperties(props, screen);
|
||||
currentStage = Integer.parseInt(props.getProperty(screen.getTitle() + ".currentStage"));
|
||||
}
|
||||
|
||||
public void store(WebSession s, Screen screen, String user)
|
||||
{
|
||||
lessonProperties.setProperty(screen.getTitle() + ".currentStage", Integer.toString(currentStage));
|
||||
super.store(s, screen, user);
|
||||
}
|
||||
|
||||
public String toString()
|
||||
{
|
||||
return super.toString() + " - currentStage:....... " + currentStage + "\n";
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,39 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class UnauthenticatedException extends Exception
|
||||
{
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
private static final long serialVersionUID = 97865025446819061L;
|
||||
|
||||
}
|
||||
@ -0,0 +1,39 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class UnauthorizedException extends Exception
|
||||
{
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
private static final long serialVersionUID = 5245519486798464814L;
|
||||
|
||||
}
|
||||
272
src/main/java/org/owasp/webgoat/session/UserTracker.java
Normal file
272
src/main/java/org/owasp/webgoat/session/UserTracker.java
Normal file
@ -0,0 +1,272 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.Collection;
|
||||
import java.util.HashMap;
|
||||
import java.util.Iterator;
|
||||
import java.util.Map;
|
||||
import org.apache.catalina.Role;
|
||||
import org.apache.catalina.User;
|
||||
import org.apache.catalina.users.MemoryUserDatabase;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created October 29, 2003
|
||||
*/
|
||||
|
||||
public class UserTracker
|
||||
{
|
||||
|
||||
private static UserTracker instance;
|
||||
|
||||
// FIXME: persist this somehow!
|
||||
|
||||
private static HashMap<String, HashMap<String, LessonTracker>> storage = new HashMap<String, HashMap<String, LessonTracker>>();
|
||||
|
||||
private static MemoryUserDatabase usersDB = new MemoryUserDatabase();
|
||||
|
||||
/**
|
||||
* Constructor for the UserTracker object
|
||||
*/
|
||||
private UserTracker()
|
||||
{
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the completed attribute of the UserTracker object
|
||||
*
|
||||
* @param userName
|
||||
* Description of the Parameter
|
||||
* @return The completed value
|
||||
*/
|
||||
public int getCompleted(String userName)
|
||||
{
|
||||
|
||||
HashMap usermap = getUserMap(userName);
|
||||
|
||||
Iterator i = usermap.entrySet().iterator();
|
||||
|
||||
int count = 0;
|
||||
|
||||
while (i.hasNext())
|
||||
{
|
||||
|
||||
Map.Entry entry = (Map.Entry) i.next();
|
||||
|
||||
int value = ((Integer) entry.getValue()).intValue();
|
||||
|
||||
if (value > 5)
|
||||
{
|
||||
count++;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
return count;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the users attribute of the UserTracker object
|
||||
*
|
||||
* @return The users value
|
||||
*/
|
||||
public Collection getUsers()
|
||||
{
|
||||
return storage.keySet();
|
||||
}
|
||||
|
||||
public Collection<String> getAllUsers(String roleName)
|
||||
{
|
||||
synchronized (usersDB)
|
||||
{
|
||||
Collection<String> allUsers = new ArrayList<String>();
|
||||
try
|
||||
{
|
||||
usersDB.open();
|
||||
Iterator users = usersDB.getUsers();
|
||||
while (users.hasNext())
|
||||
{
|
||||
User user = (User) users.next();
|
||||
Iterator roles = user.getRoles();
|
||||
while (roles.hasNext())
|
||||
{
|
||||
Role role = (Role) roles.next();
|
||||
if (role.getRolename().trim().equals(roleName))
|
||||
{
|
||||
allUsers.add(user.getUsername());
|
||||
}
|
||||
}
|
||||
}
|
||||
usersDB.close();
|
||||
} catch (Exception e)
|
||||
{
|
||||
}
|
||||
return allUsers;
|
||||
}
|
||||
}
|
||||
|
||||
public void deleteUser(String user)
|
||||
{
|
||||
synchronized (usersDB)
|
||||
{
|
||||
try
|
||||
{
|
||||
usersDB.open();
|
||||
Iterator users = usersDB.getUsers();
|
||||
while (users.hasNext())
|
||||
{
|
||||
User tomcatUser = (User) users.next();
|
||||
if (tomcatUser.getUsername().equals(user))
|
||||
{
|
||||
usersDB.removeUser(tomcatUser);
|
||||
// FIXME: delete all the lesson tracking property files
|
||||
break;
|
||||
}
|
||||
}
|
||||
usersDB.close();
|
||||
|
||||
} catch (Exception e)
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the lessonTracker attribute of the UserTracker object
|
||||
*
|
||||
* @param screen
|
||||
* Description of the Parameter
|
||||
* @param userName
|
||||
* Description of the Parameter
|
||||
* @return The lessonTracker value
|
||||
*/
|
||||
public LessonTracker getLessonTracker(WebSession s, Screen screen)
|
||||
{
|
||||
return getLessonTracker(s, s.getUserName(), screen);
|
||||
}
|
||||
|
||||
public LessonTracker getLessonTracker(WebSession s, String user, Screen screen)
|
||||
{
|
||||
HashMap<String, LessonTracker> usermap = getUserMap(user);
|
||||
LessonTracker tracker = (LessonTracker) usermap.get(screen.getTitle());
|
||||
if (tracker == null)
|
||||
{
|
||||
// Creates a new lesson tracker, if one does not exist on disk.
|
||||
tracker = LessonTracker.load(s, user, screen);
|
||||
usermap.put(screen.getTitle(), tracker);
|
||||
}
|
||||
// System.out.println( "User: [" + userName + "] UserTracker:getLessonTracker() LTH " +
|
||||
// tracker.hashCode() + " for " + screen );
|
||||
return tracker;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the status attribute of the UserTracker object
|
||||
*
|
||||
* @param screen
|
||||
* Description of the Parameter
|
||||
* @param userName
|
||||
* Description of the Parameter
|
||||
* @return The status value
|
||||
*/
|
||||
public String getStatus(WebSession s, Screen screen)
|
||||
{
|
||||
return ("User [" + s.getUserName() + "] has accessed " + screen + " UserTracker:getStatus()LTH = " + getLessonTracker(
|
||||
s,
|
||||
screen)
|
||||
.hashCode());
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the userMap attribute of the UserTracker object
|
||||
*
|
||||
* @param userName
|
||||
* Description of the Parameter
|
||||
* @return The userMap value
|
||||
*/
|
||||
private HashMap<String, LessonTracker> getUserMap(String userName)
|
||||
{
|
||||
|
||||
HashMap<String, LessonTracker> usermap = storage.get(userName);
|
||||
|
||||
if (usermap == null)
|
||||
{
|
||||
|
||||
usermap = new HashMap<String, LessonTracker>();
|
||||
|
||||
storage.put(userName, usermap);
|
||||
|
||||
}
|
||||
|
||||
return (usermap);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public static synchronized UserTracker instance()
|
||||
{
|
||||
|
||||
if (instance == null)
|
||||
{
|
||||
|
||||
instance = new UserTracker();
|
||||
|
||||
}
|
||||
|
||||
return instance;
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param screen
|
||||
* Description of the Parameter
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
*/
|
||||
public void update(WebSession s, Screen screen)
|
||||
{
|
||||
|
||||
LessonTracker tracker = getLessonTracker(s, screen);
|
||||
|
||||
// System.out.println( "User [" + s.getUserName() + "] TRACKER: updating " + screen +
|
||||
// " LTH " + tracker.hashCode() );
|
||||
tracker.store(s, screen);
|
||||
|
||||
HashMap<String, LessonTracker> usermap = getUserMap(s.getUserName());
|
||||
usermap.put(screen.getTitle(), tracker);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,48 @@
|
||||
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class ValidationException extends Exception
|
||||
{
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
private static final long serialVersionUID = -8358754606830400708L;
|
||||
|
||||
public ValidationException()
|
||||
{
|
||||
super();
|
||||
}
|
||||
|
||||
public ValidationException(String message)
|
||||
{
|
||||
super(message);
|
||||
}
|
||||
}
|
||||
1044
src/main/java/org/owasp/webgoat/session/WebSession.java
Normal file
1044
src/main/java/org/owasp/webgoat/session/WebSession.java
Normal file
File diff suppressed because it is too large
Load Diff
231
src/main/java/org/owasp/webgoat/session/WebgoatContext.java
Normal file
231
src/main/java/org/owasp/webgoat/session/WebgoatContext.java
Normal file
@ -0,0 +1,231 @@
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import javax.servlet.http.HttpServlet;
|
||||
|
||||
import org.owasp.webgoat.util.WebGoatI18N;
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
|
||||
public class WebgoatContext {
|
||||
|
||||
final Logger logger = LoggerFactory.getLogger(WebgoatContext.class);
|
||||
|
||||
public final static String DATABASE_CONNECTION_STRING = "DatabaseConnectionString";
|
||||
|
||||
public final static String DATABASE_DRIVER = "DatabaseDriver";
|
||||
|
||||
public final static String DATABASE_USER = "DatabaseUser";
|
||||
|
||||
public final static String DATABASE_PASSWORD = "DatabasePassword";
|
||||
|
||||
public final static String ENTERPRISE = "Enterprise";
|
||||
|
||||
public final static String CODING_EXERCISES = "CodingExercises";
|
||||
|
||||
public final static String SHOWCOOKIES = "ShowCookies";
|
||||
|
||||
public final static String SHOWPARAMS = "ShowParams";
|
||||
|
||||
public final static String SHOWREQUEST = "ShowRequest";
|
||||
|
||||
public final static String SHOWSOURCE = "ShowSource";
|
||||
|
||||
public final static String SHOWSOLUTION = "ShowSolution";
|
||||
|
||||
public final static String SHOWHINTS = "ShowHints";
|
||||
|
||||
public final static String DEFUSEOSCOMMANDS = "DefuseOSCommands";
|
||||
|
||||
public final static String FEEDBACK_ADDRESS_HTML = "FeedbackAddressHTML";
|
||||
|
||||
public final static String FEEDBACK_ADDRESS = "email";
|
||||
|
||||
public final static String DEBUG = "debug";
|
||||
|
||||
public final static String DEFAULTLANGUAGE = "DefaultLanguage";
|
||||
|
||||
private String databaseConnectionString;
|
||||
|
||||
private String realConnectionString = null;
|
||||
|
||||
private String databaseDriver;
|
||||
|
||||
private String databaseUser;
|
||||
|
||||
private String databasePassword;
|
||||
|
||||
private boolean showCookies = false;
|
||||
|
||||
private boolean showParams = false;
|
||||
|
||||
private boolean showRequest = false;
|
||||
|
||||
private boolean showSource = false;
|
||||
|
||||
private boolean showSolution = false;
|
||||
|
||||
private boolean defuseOSCommands = false;
|
||||
|
||||
private boolean enterprise = false;
|
||||
|
||||
private boolean codingExercises = false;
|
||||
|
||||
private String feedbackAddress = "webgoat@owasp.org";
|
||||
|
||||
private String feedbackAddressHTML = "<A HREF=mailto:webgoat@owasp.org>webgoat@owasp.org</A>";
|
||||
|
||||
private boolean isDebug = false;
|
||||
|
||||
private String servletName;
|
||||
|
||||
private HttpServlet servlet;
|
||||
|
||||
private String defaultLanguage;
|
||||
|
||||
private WebGoatI18N webgoati18n = null;
|
||||
|
||||
public WebgoatContext(HttpServlet servlet) {
|
||||
this.servlet = servlet;
|
||||
databaseConnectionString = getParameter(servlet, DATABASE_CONNECTION_STRING);
|
||||
databaseDriver = getParameter(servlet, DATABASE_DRIVER);
|
||||
databaseUser = getParameter(servlet, DATABASE_USER);
|
||||
databasePassword = getParameter(servlet, DATABASE_PASSWORD);
|
||||
|
||||
// initialize from web.xml
|
||||
showParams = "true".equals(getParameter(servlet, SHOWPARAMS));
|
||||
showCookies = "true".equals(getParameter(servlet, SHOWCOOKIES));
|
||||
showSource = "true".equals(getParameter(servlet, SHOWSOURCE));
|
||||
showSolution = "true".equals(getParameter(servlet, SHOWSOLUTION));
|
||||
defuseOSCommands = "true".equals(getParameter(servlet, DEFUSEOSCOMMANDS));
|
||||
enterprise = "true".equals(getParameter(servlet, ENTERPRISE));
|
||||
codingExercises = "true".equals(getParameter(servlet, CODING_EXERCISES));
|
||||
feedbackAddressHTML = getParameter(servlet, FEEDBACK_ADDRESS_HTML) != null ? getParameter(servlet,
|
||||
FEEDBACK_ADDRESS_HTML)
|
||||
: feedbackAddressHTML;
|
||||
feedbackAddress = getParameter(servlet, FEEDBACK_ADDRESS) != null ? getParameter(servlet, FEEDBACK_ADDRESS)
|
||||
: feedbackAddress;
|
||||
showRequest = "true".equals(getParameter(servlet, SHOWREQUEST));
|
||||
isDebug = "true".equals(getParameter(servlet, DEBUG));
|
||||
servletName = servlet.getServletName();
|
||||
defaultLanguage = getParameter(servlet, DEFAULTLANGUAGE) != null ? new String(getParameter(servlet, DEFAULTLANGUAGE)) : new String("English");
|
||||
|
||||
webgoati18n = new WebGoatI18N(this);
|
||||
|
||||
}
|
||||
|
||||
private String getParameter(HttpServlet servlet, String key) {
|
||||
String value = System.getenv().get(key);
|
||||
if (value == null) {
|
||||
value = servlet.getInitParameter(key);
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
/**
|
||||
* returns the connection string with the real path to the database
|
||||
* directory inserted at the word PATH
|
||||
*
|
||||
* @return The databaseConnectionString value
|
||||
*/
|
||||
public String getDatabaseConnectionString() {
|
||||
if (realConnectionString == null) {
|
||||
try {
|
||||
String path = servlet.getServletContext().getRealPath("/database").replace('\\', '/');
|
||||
System.out.println("PATH: " + path);
|
||||
realConnectionString = databaseConnectionString.replaceAll("PATH", path);
|
||||
System.out.println("Database Connection String: " + realConnectionString);
|
||||
} catch (Exception e) {
|
||||
logger.error("Couldn't open database: check web.xml database parameters", e);
|
||||
}
|
||||
}
|
||||
return realConnectionString;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the databaseDriver attribute of the WebSession object
|
||||
*
|
||||
* @return The databaseDriver value
|
||||
*/
|
||||
public String getDatabaseDriver() {
|
||||
return (databaseDriver);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the databaseUser attribute of the WebSession object
|
||||
*
|
||||
* @return The databaseUser value
|
||||
*/
|
||||
public String getDatabaseUser() {
|
||||
return (databaseUser);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the databasePassword attribute of the WebSession object
|
||||
*
|
||||
* @return The databasePassword value
|
||||
*/
|
||||
public String getDatabasePassword() {
|
||||
return (databasePassword);
|
||||
}
|
||||
|
||||
public boolean isDefuseOSCommands() {
|
||||
return defuseOSCommands;
|
||||
}
|
||||
|
||||
public boolean isEnterprise() {
|
||||
return enterprise;
|
||||
}
|
||||
|
||||
public boolean isCodingExercises() {
|
||||
return codingExercises;
|
||||
}
|
||||
|
||||
public String getFeedbackAddress() {
|
||||
return feedbackAddress;
|
||||
}
|
||||
|
||||
public String getFeedbackAddressHTML() {
|
||||
return feedbackAddressHTML;
|
||||
}
|
||||
|
||||
public boolean isDebug() {
|
||||
return isDebug;
|
||||
}
|
||||
|
||||
public String getServletName() {
|
||||
return servletName;
|
||||
}
|
||||
|
||||
public boolean isShowCookies() {
|
||||
return showCookies;
|
||||
}
|
||||
|
||||
public boolean isShowParams() {
|
||||
return showParams;
|
||||
}
|
||||
|
||||
public boolean isShowRequest() {
|
||||
return showRequest;
|
||||
}
|
||||
|
||||
public boolean isShowSource() {
|
||||
return showSource;
|
||||
}
|
||||
|
||||
public boolean isShowSolution() {
|
||||
return showSolution;
|
||||
}
|
||||
|
||||
public String getDefaultLanguage() {
|
||||
return defaultLanguage;
|
||||
}
|
||||
|
||||
public void setWebgoatiI18N(WebGoatI18N webgoati18n) {
|
||||
this.webgoati18n = webgoati18n;
|
||||
}
|
||||
|
||||
public WebGoatI18N getWebgoatI18N() {
|
||||
return webgoati18n;
|
||||
}
|
||||
|
||||
}
|
||||
119
src/main/java/org/owasp/webgoat/session/WebgoatProperties.java
Normal file
119
src/main/java/org/owasp/webgoat/session/WebgoatProperties.java
Normal file
@ -0,0 +1,119 @@
|
||||
package org.owasp.webgoat.session;
|
||||
|
||||
import java.io.File;
|
||||
import java.io.FileInputStream;
|
||||
import java.io.IOException;
|
||||
import java.util.Properties;
|
||||
import org.owasp.webgoat.HammerHead;
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
|
||||
/**
|
||||
* *************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class WebgoatProperties extends Properties {
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
private static final long serialVersionUID = 4351681705558227918L;
|
||||
final Logger logger = LoggerFactory.getLogger(WebgoatProperties.class);
|
||||
|
||||
public WebgoatProperties(String propertiesFileName) throws IOException {
|
||||
if (propertiesFileName == null) {
|
||||
throw new IOException("Path to webgoat.properties is null, initialization must have failed");
|
||||
}
|
||||
File propertiesFile = new File(propertiesFileName);
|
||||
if (propertiesFile.exists() == false) {
|
||||
throw new IOException("Unable to locate webgoat.properties at: " + propertiesFileName);
|
||||
}
|
||||
FileInputStream in = new FileInputStream(propertiesFile);
|
||||
load(in);
|
||||
}
|
||||
|
||||
public int getIntProperty(String key, int defaultValue) {
|
||||
int value = defaultValue;
|
||||
|
||||
String s = getProperty(key);
|
||||
if (s != null) {
|
||||
value = Integer.parseInt(s);
|
||||
}
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
public boolean getBooleanProperty(String key, boolean defaultValue) {
|
||||
boolean value = defaultValue;
|
||||
key = this.trimLesson(key);
|
||||
|
||||
String s = getProperty(key);
|
||||
if (s != null) {
|
||||
if (s.equalsIgnoreCase("true")) {
|
||||
value = true;
|
||||
} else if (s.equalsIgnoreCase("yes")) {
|
||||
value = true;
|
||||
} else if (s.equalsIgnoreCase("on")) {
|
||||
value = true;
|
||||
} else if (s.equalsIgnoreCase("false")) {
|
||||
value = false;
|
||||
} else if (s.equalsIgnoreCase("no")) {
|
||||
value = false;
|
||||
} else if (s.equalsIgnoreCase("off")) {
|
||||
value = false;
|
||||
}
|
||||
}
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
private String trimLesson(String lesson) {
|
||||
String result = "";
|
||||
|
||||
if (lesson.startsWith("org.owasp.webgoat.lessons.")) {
|
||||
result = lesson.substring("org.owasp.webgoat.lessons.".length(), lesson.length());
|
||||
} else {
|
||||
result = lesson;
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
public static void main(String[] args) {
|
||||
WebgoatProperties properties = null;
|
||||
try {
|
||||
properties = new WebgoatProperties("C:\\webgoat.properties");
|
||||
} catch (IOException e) {
|
||||
System.out.println("Error loading properties");
|
||||
e.printStackTrace();
|
||||
}
|
||||
System.out.println(properties.getProperty("CommandInjection.category"));
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user