refactor: move plugin messages

It is now done afterward through an interceptor. No more need to burden assignments with plugin messages etc. Only return the key and the optional args.

src/main/java/org/owasp/webgoat/container/WebGoat.java

@@ -33,7 +33,6 @@ package org.owasp.webgoat.container;
 
 import java.io.File;
 import org.owasp.webgoat.container.session.LessonSession;
-import org.owasp.webgoat.container.users.UserRepository;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
 import org.springframework.boot.autoconfigure.domain.EntityScan;
@@ -54,12 +53,6 @@ import org.springframework.web.client.RestTemplate;
 @EntityScan(basePackages = "org.owasp.webgoat.container")
 public class WebGoat {
 
-  private final UserRepository userRepository;
-
-  public WebGoat(UserRepository userRepository) {
-    this.userRepository = userRepository;
-  }
-
   @Bean(name = "pluginTargetDirectory")
   public File pluginTargetDirectory(@Value("${webgoat.user.directory}") final String webgoatHome) {
     return new File(webgoatHome);

src/main/java/org/owasp/webgoat/container/assignments/AssignmentEndpoint.java

@@ -25,51 +25,4 @@
 
 package org.owasp.webgoat.container.assignments;
 
-import org.owasp.webgoat.container.i18n.PluginMessages;
-import org.springframework.beans.factory.annotation.Autowired;
-
-public abstract class AssignmentEndpoint {
-
-  // TODO: move this to different bean.
-  @Autowired private PluginMessages messages;
-
-  /**
-   * Convenience method for create a successful result:
-   *
-   * <p>- Assignment is set to solved - Feedback message is set to 'assignment.solved'
-   *
-   * <p>Of course you can overwrite these values in a specific lesson
-   *
-   * @return a builder for creating a result from a lesson
-   * @param assignment
-   */
-  protected AttackResult.AttackResultBuilder success(AssignmentEndpoint assignment) {
-    return AttackResult.builder(messages)
-        .lessonCompleted(true)
-        .attemptWasMade()
-        .feedback("assignment.solved")
-        .assignment(assignment);
-  }
-
-  /**
-   * Convenience method for create a failed result:
-   *
-   * <p>- Assignment is set to not solved - Feedback message is set to 'assignment.not.solved'
-   *
-   * <p>Of course you can overwrite these values in a specific lesson
-   *
-   * @return a builder for creating a result from a lesson
-   * @param assignment
-   */
-  protected AttackResult.AttackResultBuilder failed(AssignmentEndpoint assignment) {
-    return AttackResult.builder(messages)
-        .lessonCompleted(false)
-        .attemptWasMade()
-        .feedback("assignment.not.solved")
-        .assignment(assignment);
-  }
-
-  protected AttackResult.AttackResultBuilder informationMessage(AssignmentEndpoint assignment) {
-    return AttackResult.builder(messages).lessonCompleted(false).assignment(assignment);
-  }
-}
+public abstract class AssignmentEndpoint {}

src/main/java/org/owasp/webgoat/container/assignments/AttackResult.java

@@ -30,80 +30,16 @@ import static org.apache.commons.text.StringEscapeUtils.escapeJson;
 import lombok.Getter;
 import org.owasp.webgoat.container.i18n.PluginMessages;
 
+@Getter
 public class AttackResult {
 
-  public static class AttackResultBuilder {
-
-    private boolean lessonCompleted;
-    private PluginMessages messages;
-    private Object[] feedbackArgs;
-    private String feedbackResourceBundleKey;
-    private String output;
-    private Object[] outputArgs;
-    private AssignmentEndpoint assignment;
-    private boolean attemptWasMade = false;
-
-    public AttackResultBuilder(PluginMessages messages) {
-      this.messages = messages;
-    }
-
-    public AttackResultBuilder lessonCompleted(boolean lessonCompleted) {
-      this.lessonCompleted = lessonCompleted;
-      this.feedbackResourceBundleKey = "lesson.completed";
-      return this;
-    }
-
-    public AttackResultBuilder lessonCompleted(boolean lessonCompleted, String resourceBundleKey) {
-      this.lessonCompleted = lessonCompleted;
-      this.feedbackResourceBundleKey = resourceBundleKey;
-      return this;
-    }
-
-    public AttackResultBuilder feedbackArgs(Object... args) {
-      this.feedbackArgs = args;
-      return this;
-    }
-
-    public AttackResultBuilder feedback(String resourceBundleKey) {
-      this.feedbackResourceBundleKey = resourceBundleKey;
-      return this;
-    }
-
-    public AttackResultBuilder output(String output) {
-      this.output = output;
-      return this;
-    }
-
-    public AttackResultBuilder outputArgs(Object... args) {
-      this.outputArgs = args;
-      return this;
-    }
-
-    public AttackResultBuilder attemptWasMade() {
-      this.attemptWasMade = true;
-      return this;
-    }
-
-    public AttackResult build() {
-      return new AttackResult(
-          lessonCompleted,
-          messages.getMessage(feedbackResourceBundleKey, feedbackArgs),
-          messages.getMessage(output, output, outputArgs),
-          assignment.getClass().getSimpleName(),
-          attemptWasMade);
-    }
-
-    public AttackResultBuilder assignment(AssignmentEndpoint assignment) {
-      this.assignment = assignment;
-      return this;
-    }
-  }
-
-  @Getter private boolean lessonCompleted;
-  @Getter private String feedback;
-  @Getter private String output;
-  @Getter private final String assignment;
-  @Getter private boolean attemptWasMade;
+  private boolean lessonCompleted;
+  private String feedback;
+  private Object[] feedbackArgs;
+  private String output;
+  private Object[] outputArgs;
+  private final String assignment;
+  private boolean attemptWasMade;
 
   public AttackResult(
       boolean lessonCompleted,
@@ -118,11 +54,33 @@ public class AttackResult {
     this.attemptWasMade = attemptWasMade;
   }
 
-  public static AttackResultBuilder builder(PluginMessages messages) {
-    return new AttackResultBuilder(messages);
+  public AttackResult(
+      boolean lessonCompleted,
+      String feedback,
+      Object[] feedbackArgs,
+      String output,
+      Object[] outputArgs,
+      String assignment,
+      boolean attemptWasMade) {
+    this.lessonCompleted = lessonCompleted;
+    this.feedback = feedback;
+    this.feedbackArgs = feedbackArgs;
+    this.output = output;
+    this.outputArgs = outputArgs;
+    this.assignment = assignment;
+    this.attemptWasMade = attemptWasMade;
   }
 
   public boolean assignmentSolved() {
     return lessonCompleted;
   }
+
+  public AttackResult apply(PluginMessages pluginMessages) {
+    return new AttackResult(
+        lessonCompleted,
+        pluginMessages.getMessage(feedback, feedback, feedbackArgs),
+        pluginMessages.getMessage(output, output, outputArgs),
+        assignment,
+        attemptWasMade);
+  }
 }

src/main/java/org/owasp/webgoat/container/assignments/AttackResultBuilder.java

@@ -0,0 +1,138 @@
+package org.owasp.webgoat.container.assignments;
+
+import org.owasp.webgoat.container.i18n.PluginMessages;
+
+public class AttackResultBuilder {
+
+  private PluginMessages messages;
+  private boolean lessonCompleted;
+  private Object[] feedbackArgs;
+  private String feedbackResourceBundleKey;
+  private String output;
+  private Object[] outputArgs;
+  private AssignmentEndpoint assignment;
+  private boolean attemptWasMade = false;
+  private boolean assignmentCompleted;
+
+  public AttackResultBuilder(PluginMessages messages) {
+    this.messages = messages;
+  }
+
+  public AttackResultBuilder() {}
+
+  public AttackResultBuilder lessonCompleted(boolean lessonCompleted) {
+    this.lessonCompleted = lessonCompleted;
+    this.feedbackResourceBundleKey = "lesson.completed";
+    return this;
+  }
+
+  public AttackResultBuilder lessonCompleted(boolean lessonCompleted, String resourceBundleKey) {
+    this.lessonCompleted = lessonCompleted;
+    this.feedbackResourceBundleKey = resourceBundleKey;
+    return this;
+  }
+
+  public AttackResultBuilder assignmentCompleted(boolean assignmentCompleted) {
+    this.assignmentCompleted = assignmentCompleted;
+    this.feedbackResourceBundleKey = "assignment.completed";
+    return this;
+  }
+
+  public AttackResultBuilder assignmentCompleted(
+      boolean assignmentCompleted, String resourceBundleKey) {
+    this.assignmentCompleted = assignmentCompleted;
+    this.feedbackResourceBundleKey = resourceBundleKey;
+    return this;
+  }
+
+  public AttackResultBuilder feedbackArgs(Object... args) {
+    this.feedbackArgs = args;
+    return this;
+  }
+
+  public AttackResultBuilder feedback(String resourceBundleKey) {
+    this.feedbackResourceBundleKey = resourceBundleKey;
+    return this;
+  }
+
+  public AttackResultBuilder output(String output) {
+    this.output = output;
+    return this;
+  }
+
+  public AttackResultBuilder outputArgs(Object... args) {
+    this.outputArgs = args;
+    return this;
+  }
+
+  public AttackResultBuilder attemptWasMade() {
+    this.attemptWasMade = true;
+    return this;
+  }
+
+  public AttackResult build() {
+    return new AttackResult(
+        lessonCompleted,
+        feedbackResourceBundleKey,
+        feedbackArgs,
+        output,
+        outputArgs,
+        assignment.getClass().getSimpleName(),
+        attemptWasMade);
+  }
+
+  public AttackResultBuilder assignment(AssignmentEndpoint assignment) {
+    this.assignment = assignment;
+    return this;
+  }
+
+  /**
+   * Convenience method for create a successful result:
+   *
+   * <p>- Assignment is set to solved - Feedback message is set to 'assignment.solved'
+   *
+   * <p>Of course you can overwrite these values in a specific lesson
+   *
+   * @return a builder for creating a result from a lesson
+   * @param assignment
+   */
+  public AttackResultBuilder oldSuccess(AssignmentEndpoint assignment) {
+    return this.lessonCompleted(true)
+        .assignmentCompleted(true)
+        .attemptWasMade()
+        .feedback("assignment.solved")
+        .assignment(assignment);
+  }
+
+  public static AttackResultBuilder success(AssignmentEndpoint assignment) {
+    return new AttackResultBuilder()
+        .lessonCompleted(true)
+        .assignmentCompleted(true)
+        .attemptWasMade()
+        .feedback("assignment.solved")
+        .assignment(assignment);
+  }
+
+  /**
+   * Convenience method for create a failed result:
+   *
+   * <p>- Assignment is set to not solved - Feedback message is set to 'assignment.not.solved'
+   *
+   * <p>Of course you can overwrite these values in a specific lesson
+   *
+   * @return a builder for creating a result from a lesson
+   * @param assignment
+   */
+  public static AttackResultBuilder failed(AssignmentEndpoint assignment) {
+    return new AttackResultBuilder()
+        .lessonCompleted(false)
+        .assignmentCompleted(true)
+        .attemptWasMade()
+        .feedback("assignment.not.solved")
+        .assignment(assignment);
+  }
+
+  public static AttackResultBuilder informationMessage(AssignmentEndpoint assignment) {
+    return new AttackResultBuilder().lessonCompleted(false).assignment(assignment);
+  }
+}

src/main/java/org/owasp/webgoat/container/assignments/AttackResultMessageResponseBodyAdvice.java

@@ -0,0 +1,41 @@
+package org.owasp.webgoat.container.assignments;
+
+import org.owasp.webgoat.container.i18n.PluginMessages;
+import org.springframework.core.MethodParameter;
+import org.springframework.http.MediaType;
+import org.springframework.http.converter.HttpMessageConverter;
+import org.springframework.http.server.ServerHttpRequest;
+import org.springframework.http.server.ServerHttpResponse;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+import org.springframework.web.servlet.mvc.method.annotation.ResponseBodyAdvice;
+
+/** This class intercepts the response body and applies the plugin messages to the attack result. */
+@RestControllerAdvice
+public class AttackResultMessageResponseBodyAdvice implements ResponseBodyAdvice<Object> {
+
+  private final PluginMessages pluginMessages;
+
+  public AttackResultMessageResponseBodyAdvice(PluginMessages pluginMessages) {
+    this.pluginMessages = pluginMessages;
+  }
+
+  @Override
+  public boolean supports(
+      MethodParameter returnType, Class<? extends HttpMessageConverter<?>> converterType) {
+    return true;
+  }
+
+  @Override
+  public Object beforeBodyWrite(
+      Object body,
+      MethodParameter returnType,
+      MediaType selectedContentType,
+      Class<? extends HttpMessageConverter<?>> selectedConverterType,
+      ServerHttpRequest request,
+      ServerHttpResponse response) {
+    if (body instanceof AttackResult a) {
+      return a.apply(pluginMessages);
+    }
+    return body;
+  }
+}

src/main/java/org/owasp/webgoat/lessons/authbypass/VerifyAccount.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.authbypass;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import java.io.IOException;

src/main/java/org/owasp/webgoat/lessons/bypassrestrictions/BypassRestrictionsFieldRestrictions.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.bypassrestrictions;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.springframework.web.bind.annotation.PostMapping;

src/main/java/org/owasp/webgoat/lessons/bypassrestrictions/BypassRestrictionsFrontendValidation.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.bypassrestrictions;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.springframework.web.bind.annotation.PostMapping;

src/main/java/org/owasp/webgoat/lessons/challenges/FlagController.java

@@ -22,7 +22,9 @@
 
 package org.owasp.webgoat.lessons.challenges;
 
-import lombok.AllArgsConstructor;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -32,11 +34,14 @@ import org.springframework.web.bind.annotation.ResponseBody;
 import org.springframework.web.bind.annotation.RestController;
 
 @RestController
-@AllArgsConstructor
 public class FlagController extends AssignmentEndpoint {
 
   private final Flags flags;
 
+  public FlagController(Flags flags) {
+    this.flags = flags;
+  }
+
   @PostMapping(path = "/challenge/flag/{flagNumber}")
   @ResponseBody
   public AttackResult postFlag(@PathVariable int flagNumber, @RequestParam String flag) {

src/main/java/org/owasp/webgoat/lessons/challenges/challenge1/Assignment1.java

@@ -1,8 +1,9 @@
 package org.owasp.webgoat.lessons.challenges.challenge1;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 import static org.owasp.webgoat.lessons.challenges.SolutionConstants.PASSWORD;
 
-import lombok.RequiredArgsConstructor;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.lessons.challenges.Flags;
@@ -42,11 +43,14 @@ import org.springframework.web.bind.annotation.RestController;
  * @since August 11, 2016
  */
 @RestController
-@RequiredArgsConstructor
 public class Assignment1 extends AssignmentEndpoint {
 
   private final Flags flags;
 
+  public Assignment1(Flags flags) {
+    this.flags = flags;
+  }
+
   @PostMapping("/challenge/1")
   @ResponseBody
   public AttackResult completed(@RequestParam String username, @RequestParam String password) {

src/main/java/org/owasp/webgoat/lessons/challenges/challenge5/Assignment5.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.challenges.challenge5;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import lombok.RequiredArgsConstructor;

src/main/java/org/owasp/webgoat/lessons/challenges/challenge7/Assignment7.java

@@ -1,5 +1,7 @@
 package org.owasp.webgoat.lessons.challenges.challenge7;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import jakarta.servlet.http.HttpServletRequest;
 import java.net.URI;
 import java.net.URISyntaxException;

src/main/java/org/owasp/webgoat/lessons/chromedevtools/NetworkDummy.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.chromedevtools;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.container.session.LessonSession;

src/main/java/org/owasp/webgoat/lessons/chromedevtools/NetworkLesson.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.chromedevtools;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;

src/main/java/org/owasp/webgoat/lessons/cia/CIAQuiz.java

@@ -1,5 +1,8 @@
 package org.owasp.webgoat.lessons.cia;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -11,7 +14,7 @@ import org.springframework.web.bind.annotation.RestController;
 @RestController
 public class CIAQuiz extends AssignmentEndpoint {
 
-  String[] solutions = {"Solution 3", "Solution 1", "Solution 4", "Solution 2"};
+  private final String[] solutions = {"Solution 3", "Solution 1", "Solution 4", "Solution 2"};
   boolean[] guesses = new boolean[solutions.length];
 
   @PostMapping("/cia/quiz")

src/main/java/org/owasp/webgoat/lessons/clientsidefiltering/ClientSideFilteringAssignment.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.clientsidefiltering;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;

src/main/java/org/owasp/webgoat/lessons/clientsidefiltering/ClientSideFilteringFreeAssignment.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.clientsidefiltering;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
@@ -41,7 +44,6 @@ import org.springframework.web.bind.annotation.RestController;
   "client.side.filtering.free.hint3"
 })
 public class ClientSideFilteringFreeAssignment extends AssignmentEndpoint {
-
   public static final String SUPER_COUPON_CODE = "get_it_for_free";
 
   @PostMapping("/clientSideFiltering/getItForFree")

src/main/java/org/owasp/webgoat/lessons/cryptography/EncodingAssignment.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.cryptography;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import jakarta.servlet.http.HttpServletRequest;
 import java.util.Base64;
 import java.util.Random;

src/main/java/org/owasp/webgoat/lessons/cryptography/HashingAssignment.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.cryptography;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import jakarta.servlet.http.HttpServletRequest;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
@@ -40,7 +43,6 @@ import org.springframework.web.bind.annotation.RestController;
 @RestController
 @AssignmentHints({"crypto-hashing.hints.1", "crypto-hashing.hints.2"})
 public class HashingAssignment extends AssignmentEndpoint {
-
   public static final String[] SECRETS = {"secret", "admin", "password", "123456", "passw0rd"};
 
   @RequestMapping(path = "/crypto/hashing/md5", produces = MediaType.TEXT_HTML_VALUE)

src/main/java/org/owasp/webgoat/lessons/cryptography/SecureDefaultsAssignment.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.cryptography;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.security.NoSuchAlgorithmException;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;

src/main/java/org/owasp/webgoat/lessons/cryptography/SigningAssignment.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.cryptography;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import jakarta.servlet.http.HttpServletRequest;
 import java.security.InvalidAlgorithmParameterException;
 import java.security.KeyPair;

src/main/java/org/owasp/webgoat/lessons/cryptography/XOREncodingAssignment.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.cryptography;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;

src/main/java/org/owasp/webgoat/lessons/csrf/CSRFConfirmFlag1.java

@@ -22,11 +22,13 @@
 
 package org.owasp.webgoat.lessons.csrf;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.container.session.LessonSession;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.ResponseBody;
 import org.springframework.web.bind.annotation.RestController;
@@ -36,7 +38,11 @@ import org.springframework.web.bind.annotation.RestController;
 @AssignmentHints({"csrf-get.hint1", "csrf-get.hint2", "csrf-get.hint3", "csrf-get.hint4"})
 public class CSRFConfirmFlag1 extends AssignmentEndpoint {
 
-  @Autowired LessonSession userSessionData;
+  private final LessonSession userSessionData;
+
+  public CSRFConfirmFlag1(LessonSession userSessionData) {
+    this.userSessionData = userSessionData;
+  }
 
   @PostMapping(
       path = "/csrf/confirm-flag-1",

src/main/java/org/owasp/webgoat/lessons/csrf/CSRFFeedback.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.csrf;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import com.fasterxml.jackson.databind.DeserializationFeature;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import jakarta.servlet.http.Cookie;
@@ -34,7 +37,6 @@ import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.container.session.LessonSession;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -46,8 +48,13 @@ import org.springframework.web.bind.annotation.RestController;
 @AssignmentHints({"csrf-feedback-hint1", "csrf-feedback-hint2", "csrf-feedback-hint3"})
 public class CSRFFeedback extends AssignmentEndpoint {
 
-  @Autowired private LessonSession userSessionData;
-  @Autowired private ObjectMapper objectMapper;
+  private final LessonSession userSessionData;
+  private final ObjectMapper objectMapper;
+
+  public CSRFFeedback(LessonSession userSessionData, ObjectMapper objectMapper) {
+    this.userSessionData = userSessionData;
+    this.objectMapper = objectMapper;
+  }
 
   @PostMapping(
       value = "/csrf/feedback/message",

src/main/java/org/owasp/webgoat/lessons/csrf/CSRFLogin.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.csrf;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.CurrentUsername;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;

src/main/java/org/owasp/webgoat/lessons/csrf/ForgedReviews.java

@@ -22,6 +22,8 @@
 
 package org.owasp.webgoat.lessons.csrf;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 import static org.springframework.http.MediaType.ALL_VALUE;
 
 import com.google.common.collect.Lists;

src/main/java/org/owasp/webgoat/lessons/deserialization/InsecureDeserializationTask.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.deserialization;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InvalidClassException;

src/main/java/org/owasp/webgoat/lessons/hijacksession/HijackSessionAssignment.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.hijacksession;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletResponse;
 import org.apache.commons.lang3.StringUtils;
@@ -30,7 +33,6 @@ import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.lessons.hijacksession.cas.Authentication;
 import org.owasp.webgoat.lessons.hijacksession.cas.HijackSessionAuthenticationProvider;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.CookieValue;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestParam;
@@ -52,10 +54,13 @@ import org.springframework.web.bind.annotation.RestController;
   "hijacksession.hints.5"
 })
 public class HijackSessionAssignment extends AssignmentEndpoint {
-
   private static final String COOKIE_NAME = "hijack_cookie";
 
-  @Autowired HijackSessionAuthenticationProvider provider;
+  private final HijackSessionAuthenticationProvider provider;
+
+  public HijackSessionAssignment(HijackSessionAuthenticationProvider provider) {
+    this.provider = provider;
+  }
 
   @PostMapping(path = "/HijackSession/login")
   @ResponseBody

src/main/java/org/owasp/webgoat/lessons/htmltampering/HtmlTamperingTask.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.htmltampering;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;

src/main/java/org/owasp/webgoat/lessons/httpbasics/HttpBasicsLesson.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.httpbasics;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;

src/main/java/org/owasp/webgoat/lessons/httpbasics/HttpBasicsQuiz.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.httpbasics;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AssignmentPath;

src/main/java/org/owasp/webgoat/lessons/httpproxies/HttpBasicsInterceptRequest.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.httpproxies;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import jakarta.servlet.http.HttpServletRequest;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;

src/main/java/org/owasp/webgoat/lessons/idor/IDORDiffAttributes.java

@@ -23,6 +23,9 @@
 
 package org.owasp.webgoat.lessons.idor;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;

src/main/java/org/owasp/webgoat/lessons/idor/IDOREditOtherProfile.java

@@ -23,11 +23,13 @@
 
 package org.owasp.webgoat.lessons.idor;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.container.session.LessonSession;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PutMapping;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -48,7 +50,11 @@ import org.springframework.web.bind.annotation.RestController;
 })
 public class IDOREditOtherProfile extends AssignmentEndpoint {
 
-  @Autowired private LessonSession userSessionData;
+  private final LessonSession userSessionData;
+
+  public IDOREditOtherProfile(LessonSession lessonSession) {
+    this.userSessionData = lessonSession;
+  }
 
   @PutMapping(path = "/IDOR/profile/{userId}", consumes = "application/json")
   @ResponseBody

src/main/java/org/owasp/webgoat/lessons/idor/IDORLogin.java

@@ -23,6 +23,9 @@
 
 package org.owasp.webgoat.lessons.idor;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.util.HashMap;
 import java.util.Map;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
@@ -37,14 +40,13 @@ import org.springframework.web.bind.annotation.RestController;
 @RestController
 @AssignmentHints({"idor.hints.idor_login"})
 public class IDORLogin extends AssignmentEndpoint {
-
   private final LessonSession lessonSession;
 
   public IDORLogin(LessonSession lessonSession) {
     this.lessonSession = lessonSession;
   }
 
-  private Map<String, Map<String, String>> idorUserInfo = new HashMap<>();
+  private final Map<String, Map<String, String>> idorUserInfo = new HashMap<>();
 
   public void initIDORInfo() {
 

src/main/java/org/owasp/webgoat/lessons/idor/IDORViewOtherProfile.java

@@ -23,12 +23,13 @@
 
 package org.owasp.webgoat.lessons.idor;
 
-import jakarta.servlet.http.HttpServletResponse;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.container.session.LessonSession;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.ResponseBody;
@@ -48,13 +49,17 @@ import org.springframework.web.bind.annotation.RestController;
 })
 public class IDORViewOtherProfile extends AssignmentEndpoint {
 
-  @Autowired LessonSession userSessionData;
+  private final LessonSession userSessionData;
+
+  public IDORViewOtherProfile(LessonSession userSessionData) {
+    this.userSessionData = userSessionData;
+  }
 
   @GetMapping(
       path = "/IDOR/profile/{userId}",
       produces = {"application/json"})
   @ResponseBody
-  public AttackResult completed(@PathVariable("userId") String userId, HttpServletResponse resp) {
+  public AttackResult completed(@PathVariable("userId") String userId) {
 
     Object obj = userSessionData.getValue("idor-authenticated-as");
     if (obj != null && obj.equals("tom")) {

src/main/java/org/owasp/webgoat/lessons/idor/IDORViewOwnProfile.java

@@ -27,7 +27,6 @@ import java.util.HashMap;
 import java.util.Map;
 import lombok.extern.slf4j.Slf4j;
 import org.owasp.webgoat.container.session.LessonSession;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.ResponseBody;
 import org.springframework.web.bind.annotation.RestController;
@@ -36,7 +35,11 @@ import org.springframework.web.bind.annotation.RestController;
 @Slf4j
 public class IDORViewOwnProfile {
 
-  @Autowired LessonSession userSessionData;
+  private final LessonSession userSessionData;
+
+  public IDORViewOwnProfile(LessonSession userSessionData) {
+    this.userSessionData = userSessionData;
+  }
 
   @GetMapping(
       path = {"/IDOR/own", "/IDOR/profile"},
@@ -60,7 +63,7 @@ public class IDORViewOwnProfile {
             "You do not have privileges to view the profile. Authenticate as tom first please.");
       }
     } catch (Exception ex) {
-      log.error("something went wrong", ex.getMessage());
+      log.error("something went wrong: {}", ex.getMessage());
     }
     return details;
   }

src/main/java/org/owasp/webgoat/lessons/idor/IDORViewOwnProfileAltUrl.java

@@ -23,11 +23,13 @@
 
 package org.owasp.webgoat.lessons.idor;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.container.session.LessonSession;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
@@ -40,8 +42,11 @@ import org.springframework.web.bind.annotation.RestController;
   "idor.hints.ownProfileAltUrl3"
 })
 public class IDORViewOwnProfileAltUrl extends AssignmentEndpoint {
+  private final LessonSession userSessionData;
 
-  @Autowired LessonSession userSessionData;
+  public IDORViewOwnProfileAltUrl(LessonSession userSessionData) {
+    this.userSessionData = userSessionData;
+  }
 
   @PostMapping("/IDOR/profile/alt-path")
   @ResponseBody

src/main/java/org/owasp/webgoat/lessons/insecurelogin/InsecureLoginTask.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.insecurelogin;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.springframework.http.HttpStatus;

src/main/java/org/owasp/webgoat/lessons/jwt/JWTDecodeEndpoint.java

@@ -1,5 +1,8 @@
 package org.owasp.webgoat.lessons.jwt;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.springframework.web.bind.annotation.PostMapping;

src/main/java/org/owasp/webgoat/lessons/jwt/JWTQuiz.java

@@ -1,5 +1,8 @@
 package org.owasp.webgoat.lessons.jwt;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.springframework.web.bind.annotation.GetMapping;

src/main/java/org/owasp/webgoat/lessons/jwt/JWTRefreshEndpoint.java

@@ -22,6 +22,8 @@
 
 package org.owasp.webgoat.lessons.jwt;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 import static org.springframework.http.ResponseEntity.ok;
 
 import io.jsonwebtoken.Claims;

src/main/java/org/owasp/webgoat/lessons/jwt/JWTSecretKeyEndpoint.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.jwt;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import io.jsonwebtoken.Claims;
 import io.jsonwebtoken.Jwt;
 import io.jsonwebtoken.Jwts;

src/main/java/org/owasp/webgoat/lessons/jwt/JWTVotesEndpoint.java

@@ -25,6 +25,8 @@ package org.owasp.webgoat.lessons.jwt;
 import static java.util.Comparator.comparingLong;
 import static java.util.Optional.ofNullable;
 import static java.util.stream.Collectors.toList;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 
 import io.jsonwebtoken.Claims;
 import io.jsonwebtoken.Jwt;
@@ -72,7 +74,7 @@ public class JWTVotesEndpoint extends AssignmentEndpoint {
   private static String validUsers = "TomJerrySylvester";
 
   private static int totalVotes = 38929;
-  private Map<String, Vote> votes = new HashMap<>();
+  private final Map<String, Vote> votes = new HashMap<>();
 
   @PostConstruct
   public void initVotes() {

src/main/java/org/owasp/webgoat/lessons/jwt/claimmisuse/JWTHeaderJKUEndpoint.java

@@ -1,5 +1,8 @@
 package org.owasp.webgoat.lessons.jwt.claimmisuse;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import com.auth0.jwk.JwkException;
 import com.auth0.jwk.JwkProviderBuilder;
 import com.auth0.jwt.JWT;

src/main/java/org/owasp/webgoat/lessons/jwt/claimmisuse/JWTHeaderKIDEndpoint.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.jwt.claimmisuse;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import io.jsonwebtoken.Claims;
 import io.jsonwebtoken.JwsHeader;
 import io.jsonwebtoken.Jwt;
@@ -54,7 +57,6 @@ import org.springframework.web.bind.annotation.RestController;
 })
 @RequestMapping("/JWT/")
 public class JWTHeaderKIDEndpoint extends AssignmentEndpoint {
-
   private final LessonDataSource dataSource;
 
   private JWTHeaderKIDEndpoint(LessonDataSource dataSource) {

src/main/java/org/owasp/webgoat/lessons/lessontemplate/SampleAttack.java

@@ -22,13 +22,15 @@
 
 package org.owasp.webgoat.lessons.lessontemplate;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.util.List;
 import lombok.AllArgsConstructor;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.container.session.LessonSession;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -40,11 +42,13 @@ import org.springframework.web.bind.annotation.RestController;
 @RestController
 @AssignmentHints({"lesson-template.hints.1", "lesson-template.hints.2", "lesson-template.hints.3"})
 public class SampleAttack extends AssignmentEndpoint {
+  private static final String secretValue = "secr37Value";
 
-  String secretValue = "secr37Value";
+  private final LessonSession userSessionData;
 
-  // UserSessionData is bound to session and can be used to persist data across multiple assignments
-  @Autowired LessonSession userSessionData;
+  public SampleAttack(LessonSession userSessionData) {
+    this.userSessionData = userSessionData;
+  }
 
   @PostMapping("/lesson-template/sample-attack")
   @ResponseBody

src/main/java/org/owasp/webgoat/lessons/logging/LogBleedingTask.java

@@ -22,7 +22,9 @@
 
 package org.owasp.webgoat.lessons.logging;
 
-import jakarta.annotation.PostConstruct;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.nio.charset.StandardCharsets;
 import java.util.Base64;
 import java.util.UUID;
@@ -39,12 +41,11 @@ import org.springframework.web.bind.annotation.RestController;
 @RestController
 public class LogBleedingTask extends AssignmentEndpoint {
 
-  Logger log = LoggerFactory.getLogger(this.getClass().getName());
-  private String password;
+  private static final Logger log = LoggerFactory.getLogger(LogBleedingTask.class);
+  private final String password;
 
-  @PostConstruct
-  public void generatePassword() {
-    password = UUID.randomUUID().toString();
+  public LogBleedingTask() {
+    this.password = UUID.randomUUID().toString();
     log.info(
         "Password for admin: {}",
         Base64.getEncoder().encodeToString(password.getBytes(StandardCharsets.UTF_8)));

src/main/java/org/owasp/webgoat/lessons/logging/LogSpoofingTask.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.logging;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.apache.logging.log4j.util.Strings;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;

src/main/java/org/owasp/webgoat/lessons/missingac/MissingFunctionACHiddenMenus.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.missingac;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;

src/main/java/org/owasp/webgoat/lessons/missingac/MissingFunctionACYourHash.java

@@ -22,9 +22,10 @@
 
 package org.owasp.webgoat.lessons.missingac;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 import static org.owasp.webgoat.lessons.missingac.MissingFunctionAC.PASSWORD_SALT_SIMPLE;
 
-import lombok.RequiredArgsConstructor;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
@@ -40,11 +41,14 @@ import org.springframework.web.bind.annotation.RestController;
   "access-control.hash.hint4",
   "access-control.hash.hint5"
 })
-@RequiredArgsConstructor
 public class MissingFunctionACYourHash extends AssignmentEndpoint {
 
   private final MissingAccessControlUserRepository userRepository;
 
+  public MissingFunctionACYourHash(MissingAccessControlUserRepository userRepository) {
+    this.userRepository = userRepository;
+  }
+
   @PostMapping(
       path = "/access-control/user-hash",
       produces = {"application/json"})

src/main/java/org/owasp/webgoat/lessons/missingac/MissingFunctionACYourHashAdmin.java

@@ -22,6 +22,8 @@
 
 package org.owasp.webgoat.lessons.missingac;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 import static org.owasp.webgoat.lessons.missingac.MissingFunctionAC.PASSWORD_SALT_ADMIN;
 
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;

src/main/java/org/owasp/webgoat/lessons/passwordreset/QuestionsAssignment.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.passwordreset;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.util.HashMap;
 import java.util.Map;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;

src/main/java/org/owasp/webgoat/lessons/passwordreset/ResetLinkAssignment.java

@@ -22,6 +22,8 @@
 
 package org.owasp.webgoat.lessons.passwordreset;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 import static org.springframework.util.StringUtils.hasText;
 
 import com.google.common.collect.Maps;

src/main/java/org/owasp/webgoat/lessons/passwordreset/ResetLinkAssignmentForgotPassword.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.passwordreset;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import jakarta.servlet.http.HttpServletRequest;
 import java.util.UUID;
 import org.owasp.webgoat.container.CurrentUsername;
@@ -47,9 +50,9 @@ import org.springframework.web.client.RestTemplate;
 public class ResetLinkAssignmentForgotPassword extends AssignmentEndpoint {
 
   private final RestTemplate restTemplate;
-  private String webWolfHost;
-  private String webWolfPort;
-  private String webWolfURL;
+  private final String webWolfHost;
+  private final String webWolfPort;
+  private final String webWolfURL;
   private final String webWolfMailURL;
 
   public ResetLinkAssignmentForgotPassword(

src/main/java/org/owasp/webgoat/lessons/passwordreset/SecurityQuestionAssignment.java

@@ -23,12 +23,13 @@
 package org.owasp.webgoat.lessons.passwordreset;
 
 import static java.util.Optional.of;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.informationMessage;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 
 import java.util.HashMap;
 import java.util.Map;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
@@ -43,7 +44,7 @@ import org.springframework.web.bind.annotation.RestController;
 @RestController
 public class SecurityQuestionAssignment extends AssignmentEndpoint {
 
-  @Autowired private TriedQuestions triedQuestions;
+  private final TriedQuestions triedQuestions;
 
   private static Map<String, String> questions;
 
@@ -90,6 +91,10 @@ public class SecurityQuestionAssignment extends AssignmentEndpoint {
     questions.put("What is your favorite color?", "Can easily be guessed.");
   }
 
+  public SecurityQuestionAssignment(TriedQuestions triedQuestions) {
+    this.triedQuestions = triedQuestions;
+  }
+
   @PostMapping("/PasswordReset/SecurityQuestions")
   @ResponseBody
   public AttackResult completed(@RequestParam String question) {

src/main/java/org/owasp/webgoat/lessons/passwordreset/SimpleMailAssignment.java

@@ -23,6 +23,9 @@
 package org.owasp.webgoat.lessons.passwordreset;
 
 import static java.util.Optional.ofNullable;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.informationMessage;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 
 import java.time.LocalDateTime;
 import org.apache.commons.lang3.StringUtils;
@@ -44,7 +47,6 @@ import org.springframework.web.client.RestTemplate;
  */
 @RestController
 public class SimpleMailAssignment extends AssignmentEndpoint {
-
   private final String webWolfURL;
   private RestTemplate restTemplate;
 

src/main/java/org/owasp/webgoat/lessons/pathtraversal/ProfileUploadBase.java

@@ -1,5 +1,9 @@
 package org.owasp.webgoat.lessons.pathtraversal;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.informationMessage;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -7,7 +11,6 @@ import java.nio.file.Files;
 import java.util.Arrays;
 import java.util.Base64;
 import java.util.List;
-import lombok.AllArgsConstructor;
 import lombok.Getter;
 import lombok.SneakyThrows;
 import org.apache.commons.io.FilenameUtils;
@@ -21,11 +24,14 @@ import org.springframework.util.FileSystemUtils;
 import org.springframework.util.StringUtils;
 import org.springframework.web.multipart.MultipartFile;
 
-@AllArgsConstructor
 @Getter
 public class ProfileUploadBase extends AssignmentEndpoint {
 
-  private String webGoatHomeDirectory;
+  private final String webGoatHomeDirectory;
+
+  public ProfileUploadBase(String webGoatHomeDirectory) {
+    this.webGoatHomeDirectory = webGoatHomeDirectory;
+  }
 
   protected AttackResult execute(MultipartFile file, String fullName, String username) {
     if (file.isEmpty()) {

src/main/java/org/owasp/webgoat/lessons/pathtraversal/ProfileUploadRetrieval.java

@@ -1,5 +1,8 @@
 package org.owasp.webgoat.lessons.pathtraversal;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import jakarta.annotation.PostConstruct;
 import jakarta.servlet.http.HttpServletRequest;
 import java.io.File;
@@ -41,7 +44,6 @@ import org.springframework.web.bind.annotation.RestController;
 })
 @Slf4j
 public class ProfileUploadRetrieval extends AssignmentEndpoint {
-
   private final File catPicturesDirectory;
 
   public ProfileUploadRetrieval(@Value("${webgoat.server.directory}") String webGoatHomeDirectory) {

src/main/java/org/owasp/webgoat/lessons/pathtraversal/ProfileZipSlip.java

@@ -1,5 +1,7 @@
 package org.owasp.webgoat.lessons.pathtraversal;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 import static org.springframework.http.MediaType.ALL_VALUE;
 import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;
 

src/main/java/org/owasp/webgoat/lessons/securepasswords/SecurePasswordsAssignment.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.securepasswords;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import com.nulabinc.zxcvbn.Strength;
 import com.nulabinc.zxcvbn.Zxcvbn;
 import java.text.DecimalFormat;

src/main/java/org/owasp/webgoat/lessons/spoofcookie/SpoofCookieAssignment.java

@@ -23,6 +23,10 @@
 
 package org.owasp.webgoat.lessons.spoofcookie;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.informationMessage;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletResponse;
 import java.util.Map;

src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionChallenge.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.advanced;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.sql.*;
 import lombok.extern.slf4j.Slf4j;
 import org.owasp.webgoat.container.LessonDataSource;

src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionChallengeLogin.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.advanced;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.LessonDataSource;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
@@ -40,7 +43,6 @@ import org.springframework.web.bind.annotation.RestController;
       "SqlInjectionChallengeHint4"
     })
 public class SqlInjectionChallengeLogin extends AssignmentEndpoint {
-
   private final LessonDataSource dataSource;
 
   public SqlInjectionChallengeLogin(LessonDataSource dataSource) {

src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionLesson6a.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.advanced;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.sql.Connection;
 import java.sql.ResultSet;
 import java.sql.ResultSetMetaData;
@@ -47,7 +50,6 @@ import org.springframework.web.bind.annotation.RestController;
       "SqlStringInjectionHint-advanced-6a-5"
     })
 public class SqlInjectionLesson6a extends AssignmentEndpoint {
-
   private final LessonDataSource dataSource;
   private static final String YOUR_QUERY_WAS = "<br> Your query was: ";
 

src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionLesson6b.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.advanced;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.io.IOException;
 import java.sql.Connection;
 import java.sql.ResultSet;
@@ -37,7 +40,6 @@ import org.springframework.web.bind.annotation.RestController;
 
 @RestController
 public class SqlInjectionLesson6b extends AssignmentEndpoint {
-
   private final LessonDataSource dataSource;
 
   public SqlInjectionLesson6b(LessonDataSource dataSource) {

src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionQuiz.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.advanced;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.io.IOException;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;

src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson10.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.introduction;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.sql.Connection;
 import java.sql.ResultSet;
 import java.sql.SQLException;
@@ -120,8 +123,7 @@ public class SqlInjectionLesson10 extends AssignmentEndpoint {
       if (errorMsg.contains("object not found: ACCESS_LOG")) {
         return false;
       } else {
-        System.err.println(e.getMessage());
-        return false;
+        return true;
       }
     }
   }

src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson2.java

@@ -24,6 +24,8 @@ package org.owasp.webgoat.lessons.sqlinjection.introduction;
 
 import static java.sql.ResultSet.CONCUR_READ_ONLY;
 import static java.sql.ResultSet.TYPE_SCROLL_INSENSITIVE;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 
 import java.sql.ResultSet;
 import java.sql.SQLException;

src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson3.java

@@ -24,6 +24,8 @@ package org.owasp.webgoat.lessons.sqlinjection.introduction;
 
 import static java.sql.ResultSet.CONCUR_READ_ONLY;
 import static java.sql.ResultSet.TYPE_SCROLL_INSENSITIVE;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 
 import java.sql.Connection;
 import java.sql.ResultSet;

src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson4.java

@@ -24,6 +24,8 @@ package org.owasp.webgoat.lessons.sqlinjection.introduction;
 
 import static java.sql.ResultSet.CONCUR_READ_ONLY;
 import static java.sql.ResultSet.TYPE_SCROLL_INSENSITIVE;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 
 import java.sql.Connection;
 import java.sql.ResultSet;

src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson5.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.introduction;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import jakarta.annotation.PostConstruct;
 import java.sql.Connection;
 import java.sql.ResultSet;

src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson5a.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.introduction;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.sql.*;
 import org.owasp.webgoat.container.LessonDataSource;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;

src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson5b.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.introduction;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.io.IOException;
 import java.sql.*;
 import org.owasp.webgoat.container.LessonDataSource;

src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson8.java

@@ -24,6 +24,8 @@ package org.owasp.webgoat.lessons.sqlinjection.introduction;
 
 import static java.sql.ResultSet.CONCUR_UPDATABLE;
 import static java.sql.ResultSet.TYPE_SCROLL_SENSITIVE;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 
 import java.sql.*;
 import java.text.SimpleDateFormat;

src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson9.java

@@ -24,6 +24,8 @@ package org.owasp.webgoat.lessons.sqlinjection.introduction;
 
 import static org.hsqldb.jdbc.JDBCResultSet.CONCUR_UPDATABLE;
 import static org.hsqldb.jdbc.JDBCResultSet.TYPE_SCROLL_SENSITIVE;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 
 import java.sql.Connection;
 import java.sql.ResultSet;
@@ -99,7 +101,6 @@ public class SqlInjectionLesson9 extends AssignmentEndpoint {
               SqlInjectionLesson8.generateTable(this.getEmployeesDataOrderBySalaryDesc(connection)))
           .build();
     } catch (SQLException e) {
-      System.err.println(e.getMessage());
       return failed(this)
           .output("<br><span class='feedback-negative'>" + e.getMessage() + "</span>")
           .build();

src/main/java/org/owasp/webgoat/lessons/sqlinjection/mitigation/SqlInjectionLesson10a.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.mitigation;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import lombok.extern.slf4j.Slf4j;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
@@ -37,7 +40,7 @@ import org.springframework.web.bind.annotation.RestController;
     value = {"SqlStringInjectionHint-mitigation-10a-1", "SqlStringInjectionHint-mitigation-10a-2"})
 public class SqlInjectionLesson10a extends AssignmentEndpoint {
 
-  private String[] results = {
+  private static final String[] results = {
     "getConnection", "PreparedStatement", "prepareStatement", "?", "?", "setString", "setString"
   };
 

src/main/java/org/owasp/webgoat/lessons/sqlinjection/mitigation/SqlInjectionLesson10b.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.mitigation;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.io.IOException;
 import java.net.URI;
 import java.util.Arrays;

src/main/java/org/owasp/webgoat/lessons/sqlinjection/mitigation/SqlInjectionLesson13.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.mitigation;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.sql.Connection;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
@@ -68,7 +71,7 @@ public class SqlInjectionLesson13 extends AssignmentEndpoint {
       return failed(this).build();
     } catch (SQLException e) {
       log.error("Failed", e);
-      return (failed(this).build());
+      return failed(this).build();
     }
   }
 }

src/main/java/org/owasp/webgoat/lessons/sqlinjection/mitigation/SqlOnlyInputValidation.java

@@ -22,6 +22,8 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.mitigation;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
@@ -52,7 +54,9 @@ public class SqlOnlyInputValidation extends AssignmentEndpoint {
     return new AttackResult(
         attackResult.isLessonCompleted(),
         attackResult.getFeedback(),
+        attackResult.getFeedbackArgs(),
         attackResult.getOutput(),
+        attackResult.getOutputArgs(),
         getClass().getSimpleName(),
         true);
   }

src/main/java/org/owasp/webgoat/lessons/sqlinjection/mitigation/SqlOnlyInputValidationOnKeywords.java

@@ -22,6 +22,8 @@
 
 package org.owasp.webgoat.lessons.sqlinjection.mitigation;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
@@ -58,7 +60,9 @@ public class SqlOnlyInputValidationOnKeywords extends AssignmentEndpoint {
     return new AttackResult(
         attackResult.isLessonCompleted(),
         attackResult.getFeedback(),
+        attackResult.getFeedbackArgs(),
         attackResult.getOutput(),
+        attackResult.getOutputArgs(),
         getClass().getSimpleName(),
         true);
   }

src/main/java/org/owasp/webgoat/lessons/ssrf/SSRFTask1.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.ssrf;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;

src/main/java/org/owasp/webgoat/lessons/ssrf/SSRFTask2.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.ssrf;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.MalformedURLException;

src/main/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLesson.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.vulnerablecomponents;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import com.thoughtworks.xstream.XStream;
 import org.apache.commons.lang3.StringUtils;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;

src/main/java/org/owasp/webgoat/lessons/webwolfintroduction/LandingAssignment.java

@@ -22,9 +22,9 @@
 
 package org.owasp.webgoat.lessons.webwolfintroduction;
 
-import jakarta.servlet.http.HttpServletRequest;
-import java.net.URI;
-import java.net.URISyntaxException;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.apache.commons.lang3.StringUtils;
 import org.owasp.webgoat.container.CurrentUsername;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
@@ -42,9 +42,11 @@ import org.springframework.web.servlet.ModelAndView;
  */
 @RestController
 public class LandingAssignment extends AssignmentEndpoint {
+  private final String landingPageUrl;
 
-  @Value("${webwolf.landingpage.url}")
-  private String landingPageUrl;
+  public LandingAssignment(@Value("${webwolf.landingpage.url}") String landingPageUrl) {
+    this.landingPageUrl = landingPageUrl;
+  }
 
   @PostMapping("/WebWolf/landing")
   @ResponseBody
@@ -56,9 +58,7 @@ public class LandingAssignment extends AssignmentEndpoint {
   }
 
   @GetMapping("/WebWolf/landing/password-reset")
-  public ModelAndView openPasswordReset(
-      HttpServletRequest request, @CurrentUsername String username) throws URISyntaxException {
-    URI uri = new URI(request.getRequestURL().toString());
+  public ModelAndView openPasswordReset(@CurrentUsername String username) {
     ModelAndView modelAndView = new ModelAndView();
     modelAndView.addObject(
         "webwolfLandingPageUrl", landingPageUrl.replace("//landing", "/landing"));

src/main/java/org/owasp/webgoat/lessons/webwolfintroduction/MailAssignment.java

@@ -22,6 +22,10 @@
 
 package org.owasp.webgoat.lessons.webwolfintroduction;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.informationMessage;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.apache.commons.lang3.StringUtils;
 import org.owasp.webgoat.container.CurrentUsername;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;

src/main/java/org/owasp/webgoat/lessons/xss/CrossSiteScriptingLesson1.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.xss;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.springframework.web.bind.annotation.PostMapping;

src/main/java/org/owasp/webgoat/lessons/xss/CrossSiteScriptingLesson5a.java

@@ -22,13 +22,15 @@
 
 package org.owasp.webgoat.lessons.xss;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.util.function.Predicate;
 import java.util.regex.Pattern;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.container.session.LessonSession;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
@@ -48,7 +50,12 @@ public class CrossSiteScriptingLesson5a extends AssignmentEndpoint {
       Pattern.compile(
               ".*<script>(console\\.log|alert)\\(.*\\);?</script>.*", Pattern.CASE_INSENSITIVE)
           .asMatchPredicate();
-  @Autowired LessonSession userSessionData;
+
+  private final LessonSession userSessionData;
+
+  public CrossSiteScriptingLesson5a(LessonSession lessonSession) {
+    this.userSessionData = lessonSession;
+  }
 
   @GetMapping("/CrossSiteScripting/attack5a")
   @ResponseBody

src/main/java/org/owasp/webgoat/lessons/xss/CrossSiteScriptingLesson6a.java

@@ -22,11 +22,13 @@
 
 package org.owasp.webgoat.lessons.xss;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.container.session.LessonSession;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
@@ -41,7 +43,11 @@ import org.springframework.web.bind.annotation.RestController;
       "xss-reflected-6a-hint-4"
     })
 public class CrossSiteScriptingLesson6a extends AssignmentEndpoint {
-  @Autowired LessonSession userSessionData;
+  private final LessonSession userSessionData;
+
+  public CrossSiteScriptingLesson6a(LessonSession userSessionData) {
+    this.userSessionData = userSessionData;
+  }
 
   @PostMapping("/CrossSiteScripting/attack6a")
   @ResponseBody

src/main/java/org/owasp/webgoat/lessons/xss/CrossSiteScriptingQuiz.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.xss;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import java.io.IOException;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
@@ -34,7 +37,9 @@ import org.springframework.web.bind.annotation.RestController;
 @RestController
 public class CrossSiteScriptingQuiz extends AssignmentEndpoint {
 
-  String[] solutions = {"Solution 4", "Solution 3", "Solution 1", "Solution 2", "Solution 4"};
+  private static final String[] solutions = {
+    "Solution 4", "Solution 3", "Solution 1", "Solution 2", "Solution 4"
+  };
   boolean[] guesses = new boolean[solutions.length];
 
   @PostMapping("/CrossSiteScripting/quiz")

src/main/java/org/owasp/webgoat/lessons/xss/DOMCrossSiteScripting.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.xss;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import jakarta.servlet.http.HttpServletRequest;
 import java.security.SecureRandom;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;

src/main/java/org/owasp/webgoat/lessons/xss/DOMCrossSiteScriptingVerifier.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.xss;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;

src/main/java/org/owasp/webgoat/lessons/xss/mitigation/CrossSiteScriptingLesson3.java

@@ -23,6 +23,9 @@
 
 package org.owasp.webgoat.lessons.xss.mitigation;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.jsoup.Jsoup;
 import org.jsoup.nodes.Document;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;

src/main/java/org/owasp/webgoat/lessons/xss/mitigation/CrossSiteScriptingLesson4.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.xss.mitigation;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;

src/main/java/org/owasp/webgoat/lessons/xss/stored/StoredCrossSiteScriptingVerifier.java

@@ -22,6 +22,9 @@
 
 package org.owasp.webgoat.lessons.xss.stored;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.container.session.LessonSession;

src/main/java/org/owasp/webgoat/lessons/xss/stored/StoredXssComments.java

@@ -22,6 +22,8 @@
 
 package org.owasp.webgoat.lessons.xss.stored;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 import static org.springframework.http.MediaType.ALL_VALUE;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -49,7 +51,7 @@ import org.springframework.web.bind.annotation.RestController;
 @RestController
 public class StoredXssComments extends AssignmentEndpoint {
 
-  private static DateTimeFormatter fmt = DateTimeFormatter.ofPattern("yyyy-MM-dd, HH:mm:ss");
+  private static final DateTimeFormatter fmt = DateTimeFormatter.ofPattern("yyyy-MM-dd, HH:mm:ss");
 
   private static final Map<String, List<Comment>> userComments = new HashMap<>();
   private static final List<Comment> comments = new ArrayList<>();

src/main/java/org/owasp/webgoat/lessons/xxe/BlindSendFileAssignment.java

@@ -2,6 +2,8 @@ package org.owasp.webgoat.lessons.xxe;
 
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 import static org.springframework.http.MediaType.ALL_VALUE;
 import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;
 

src/main/java/org/owasp/webgoat/lessons/xxe/ContentTypeAssignment.java

@@ -24,6 +24,8 @@ package org.owasp.webgoat.lessons.xxe;
 
 import static java.util.Optional.empty;
 import static java.util.Optional.of;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -36,7 +38,6 @@ import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.container.users.WebGoatUser;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.MediaType;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -53,9 +54,6 @@ public class ContentTypeAssignment extends AssignmentEndpoint {
     "Windows", "Program Files (x86)", "Program Files", "pagefile.sys"
   };
 
-  @Value("${webgoat.server.directory}")
-  private String webGoatHomeDirectory;
-
   private final CommentsCache comments;
 
   public ContentTypeAssignment(CommentsCache comments) {

src/main/java/org/owasp/webgoat/lessons/xxe/SimpleXXE.java

@@ -22,6 +22,8 @@
 
 package org.owasp.webgoat.lessons.xxe;
 
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
 import static org.springframework.http.MediaType.ALL_VALUE;
 import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;
 
@@ -32,7 +34,6 @@ import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.owasp.webgoat.container.users.WebGoatUser;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.MediaType;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -56,12 +57,6 @@ public class SimpleXXE extends AssignmentEndpoint {
     "Windows", "Program Files (x86)", "Program Files", "pagefile.sys"
   };
 
-  @Value("${webgoat.server.directory}")
-  private String webGoatHomeDirectory;
-
-  @Value("${webwolf.landingpage.url}")
-  private String webWolfURL;
-
   private final CommentsCache comments;
 
   public SimpleXXE(CommentsCache comments) {

src/main/resources/lessons/lessontemplate/documentation/lesson-template-attack.adoc

@@ -19,7 +19,7 @@ public class SampleAttack extends AssignmentEndpoint { // <3>
     public AttackResult completed(@RequestParam("param1") String param1, @RequestParam("param2") String param2) { <6>
         if (userSessionData.getValue("some-value") != null) {
             // do any session updating you want here ... or not, just comment/example here
-            //return failed(this).feedback("lesson-template.sample-attack.failure-2").build();
+            //return builder.failed(this).feedback("lesson-template.sample-attack.failure-2").build();
         }
 
         //overly simple example for success. See other existing lessons for ways to detect 'success' or 'failure'
@@ -32,7 +32,7 @@ public class SampleAttack extends AssignmentEndpoint { // <3>
         }
 
         // else
-        return failed(this) // <8>
+        return builder.failed(this) // <8>
                 .feedback("lesson-template.sample-attack.failure-2")
                 .output("Custom output for this failure scenario, usually html that will get rendered directly ... yes, you can self-xss if you want")
                 .build();