dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Language of the browser not english will crash WebGoat during loading of the asciidoc. This is due to the fact we always presume the lesson plan is available in the browser language. It now falls back to 'en' whenever the lesson cannot be found with the language obtained from the browser.

Browse Source
This commit is contained in:
Nanne Baars 2017-04-16 07:52:30 +02:00
parent 243e6d5247
commit a63bf006d6
2 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
webgoat-container/src/main/java/org/owasp/webgoat/AsciiDoctorTemplateResolver.java
View File

@ -54,11 +54,9 @@ public class AsciiDoctorTemplateResolver extends TemplateResolver {
private static final Asciidoctor asciidoctor = create(); private static final Asciidoctor asciidoctor = create();
private static final String PREFIX = "doc:"; private static final String PREFIX = "doc:";
private final File pluginTargetDirectory;
private final Language language; private final Language language;
public AsciiDoctorTemplateResolver(File pluginTargetDirectory, Language language) { public AsciiDoctorTemplateResolver(Language language) {
this.pluginTargetDirectory = pluginTargetDirectory;
this.language = language; this.language = language;
setResourceResolver(new AdocResourceResolver()); setResourceResolver(new AdocResourceResolver());
@ -75,7 +73,7 @@ public class AsciiDoctorTemplateResolver extends TemplateResolver {
@Override @Override
public InputStream getResourceAsStream(TemplateProcessingParameters params, String resourceName) { public InputStream getResourceAsStream(TemplateProcessingParameters params, String resourceName) {
InputStream is = Thread.currentThread().getContextClassLoader().getResourceAsStream(computeResourceName(resourceName)); InputStream is = readInputStreamOrFallbackToEnglish(resourceName, language);
try { try {
StringWriter writer = new StringWriter(); StringWriter writer = new StringWriter();
asciidoctor.convert(new InputStreamReader(is), writer, createAttributes()); asciidoctor.convert(new InputStreamReader(is), writer, createAttributes());
@ -90,10 +88,17 @@ public class AsciiDoctorTemplateResolver extends TemplateResolver {
* The resource name is for example HttpBasics_content1.adoc. This is always located in the following directory: * The resource name is for example HttpBasics_content1.adoc. This is always located in the following directory:
* <code>plugin/HttpBasics/lessonPlans/en/HttpBasics_content1.adoc</code> * <code>plugin/HttpBasics/lessonPlans/en/HttpBasics_content1.adoc</code>
*/ */
private String computeResourceName(String resourceName) { private String computeResourceName(String resourceName, String language) {
return String.format("lessonPlans/%s/%s", language.getLocale().getLanguage(), resourceName); return String.format("lessonPlans/%s/%s", language, resourceName);
} }
private InputStream readInputStreamOrFallbackToEnglish(String resourceName, Language language) {
InputStream is = Thread.currentThread().getContextClassLoader().getResourceAsStream(computeResourceName(resourceName, language.getLocale().getLanguage()));
if (is == null) {
is = Thread.currentThread().getContextClassLoader().getResourceAsStream(computeResourceName(resourceName, "en"));
}
return is;
}
private Map<String, Object> createAttributes() { private Map<String, Object> createAttributes() {
Map<String, Object> attributes = Maps.newHashMap(); Map<String, Object> attributes = Maps.newHashMap();

3
webgoat-container/src/main/java/org/owasp/webgoat/MvcConfiguration.java
View File

@ -95,7 +95,7 @@ public class MvcConfiguration extends WebMvcConfigurerAdapter {
@Bean @Bean
public AsciiDoctorTemplateResolver asciiDoctorTemplateResolver(Language language) { public AsciiDoctorTemplateResolver asciiDoctorTemplateResolver(Language language) {
AsciiDoctorTemplateResolver resolver = new AsciiDoctorTemplateResolver(pluginTargetDirectory, language); AsciiDoctorTemplateResolver resolver = new AsciiDoctorTemplateResolver(language);
resolver.setCacheable(false); resolver.setCacheable(false);
resolver.setOrder(3); resolver.setOrder(3);
return resolver; return resolver;
@ -120,7 +120,6 @@ public class MvcConfiguration extends WebMvcConfigurerAdapter {
@Override @Override
public void addResourceHandlers(ResourceHandlerRegistry registry) { public void addResourceHandlers(ResourceHandlerRegistry registry) {
registry.addResourceHandler("/plugin_lessons/**").addResourceLocations("file:///" + pluginTargetDirectory.toString() + "/"); registry.addResourceHandler("/plugin_lessons/**").addResourceLocations("file:///" + pluginTargetDirectory.toString() + "/");
//registry.addResourceHandler("/images/**").addResourceLocations("classpath:/plugin/VulnerableComponents/images/");
registry.addResourceHandler("/images/**").addResourceLocations("classpath:/images/"); registry.addResourceHandler("/images/**").addResourceLocations("classpath:/images/");
registry.addResourceHandler("/lesson_js/**").addResourceLocations("classpath:/js/"); registry.addResourceHandler("/lesson_js/**").addResourceLocations("classpath:/js/");
registry.addResourceHandler("/lesson_css/**").addResourceLocations("classpath:/css/"); registry.addResourceHandler("/lesson_css/**").addResourceLocations("classpath:/css/");