dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reformat of Java source. Added JavaStyle format definitions.

Browse Source 
git-svn-id: http://webgoat.googlecode.com/svn/trunk/webgoat@287 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
mayhew64
2008-02-27 00:29:19 +00:00
parent cbdff41aa8
commit a8db8989c8
126 changed files with 20713 additions and 22183 deletions
Download Patch File Download Diff File Expand all files Collapse all files

952
main/project/JavaSource/org/owasp/webgoat/util/Exec.java
View File

File diff suppressed because it is too large Load Diff

617
main/project/JavaSource/org/owasp/webgoat/util/ExecResults.java
View File

@ -1,360 +1,353 @@
package org.owasp.webgoat.util;
/*******************************************************************************
/***************************************************************************************************
*
*
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
* please see http://www.owasp.org/
*
* Copyright (c) 2002 - 2007 Bruce Mayhew
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
* This program is free software; you can redistribute it and/or modify it under the terms of the
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
* You should have received a copy of the GNU General Public License along with this program; if
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
* 02111-1307, USA.
*
* Getting Source ==============
*
* Source for this application is maintained at code.google.com, a repository
* for free software projects.
* Source for this application is maintained at code.google.com, a repository for free software
* projects.
*
* For details, please see http://code.google.com/p/webgoat/
*
*
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
*/
public class ExecResults
{
/**
* Description of the Field
*/
public final static int BADRETURNCODE = 2;
/**
* Description of the Field
*/
public final static int BADRETURNCODE = 2;
/**
* Description of the Field
*/
public final static int THROWABLE = 1;
/**
* Description of the Field
*/
public final static int THROWABLE = 1;
private String myCommand;
private String myCommand;
private boolean myError = false;
private boolean myError = false;
private int myErrorType = 0;
private int myErrorType = 0;
private String myErrors = null;
private String myErrors = null;
private String myInput;
private String myInput;
private boolean myInterrupted = false;
private boolean myInterrupted = false;
private String myOutput = null;
private String myOutput = null;
private int myReturnCode = 0;
private int myReturnCode = 0;
private int mySuccessCode;
private int mySuccessCode;
private Throwable myThrowable = null;
private Throwable myThrowable = null;
private int myTimeout;
private int myTimeout;
/**
* Constructor for the ExecResults object
*
*@param command Description of the Parameter
*@param input Description of the Parameter
*@param successCode Description of the Parameter
*@param timeout Description of the Parameter
*/
public ExecResults(String command, String input, int successCode,
int timeout)
{
myCommand = command.trim();
myInput = input.trim();
mySuccessCode = successCode;
myTimeout = timeout;
}
/**
* Description of the Method
*
*@param haystack Description of the Parameter
*@param needle Description of the Parameter
*@param fromIndex Description of the Parameter
*@return Description of the Return Value
*/
private boolean contains(String haystack, String needle, int fromIndex)
{
return (haystack.trim().toLowerCase().indexOf(
needle.trim().toLowerCase(), fromIndex) != -1);
}
/**
* Description of the Method
*
*@param value Description of the Parameter
*@return Description of the Return Value
*/
public boolean errorsContains(String value)
{
return (errorsContains(value, 0));
}
/**
* Description of the Method
*
*@param value Description of the Parameter
*@param fromIndex Description of the Parameter
*@return Description of the Return Value
*/
public boolean errorsContains(String value, int fromIndex)
{
return (contains(myErrors, value, fromIndex));
}
/**
* Gets the error attribute of the ExecResults object
*
*@return The error value
*/
public boolean getError()
{
return (myError);
}
/**
* Gets the errorMessage attribute of the ExecResults object
*
*@return The errorMessage value
*/
public String getErrorMessage()
{
switch (getErrorType())
/**
* Constructor for the ExecResults object
*
* @param command
* Description of the Parameter
* @param input
* Description of the Parameter
* @param successCode
* Description of the Parameter
* @param timeout
* Description of the Parameter
*/
public ExecResults(String command, String input, int successCode, int timeout)
{
case THROWABLE:
return ("Exception: " + myThrowable.getMessage());
case BADRETURNCODE:
return ("Bad return code (expected " + mySuccessCode + ")");
default:
return ("Unknown error");
}
}
/**
* Gets the errorType attribute of the ExecResults object
*
*@return The errorType value
*/
public int getErrorType()
{
return (myErrorType);
}
/**
* Gets the errors attribute of the ExecResults object
*
*@return The errors value
*/
public String getErrors()
{
return (myErrors);
}
/**
* Gets the interrupted attribute of the ExecResults object
*
*@return The interrupted value
*/
public boolean getInterrupted()
{
return (myInterrupted);
}
/**
* Gets the output attribute of the ExecResults object
*
*@return The output value
*/
public String getOutput()
{
return (myOutput);
}
/**
* Gets the returnCode attribute of the ExecResults object
*
*@return The returnCode value
*/
public int getReturnCode()
{
return (myReturnCode);
}
/**
* Gets the throwable attribute of the ExecResults object
*
*@return The throwable value
*/
public Throwable getThrowable()
{
return (myThrowable);
}
/**
* Description of the Method
*
*@param value Description of the Parameter
*@return Description of the Return Value
*/
public boolean outputContains(String value)
{
return (outputContains(value, 0));
}
/**
* Description of the Method
*
*@param value Description of the Parameter
*@param fromIndex Description of the Parameter
*@return Description of the Return Value
*/
public boolean outputContains(String value, int fromIndex)
{
return (contains(myOutput, value, fromIndex));
}
/**
* Sets the error attribute of the ExecResults object
*
*@param value The new error value
*/
public void setError(int value)
{
myError = true;
myErrorType = value;
}
/**
* Sets the errors attribute of the ExecResults object
*
*@param errors The new errors value
*/
public void setErrors(String errors)
{
myErrors = errors.trim();
}
/**
* Sets the interrupted attribute of the ExecResults object
*/
public void setInterrupted()
{
myInterrupted = true;
}
/**
* Sets the output attribute of the ExecResults object
*
*@param value The new output value
*/
public void setOutput(String value)
{
myOutput = value.trim();
}
/**
* Sets the returnCode attribute of the ExecResults object
*
*@param value The new returnCode value
*/
public void setReturnCode(int value)
{
myReturnCode = value;
}
/**
* Sets the throwable attribute of the ExecResults object
*
*@param value The new throwable value
*/
public void setThrowable(Throwable value)
{
setError(THROWABLE);
myThrowable = value;
}
/**
* Description of the Method
*
*@return Description of the Return Value
*/
public String toString()
{
String sep = System.getProperty("line.separator");
StringBuffer value = new StringBuffer();
value.append("ExecResults for \'" + myCommand + "\'" + sep);
if ((myInput != null) && !myInput.equals(""))
{
value.append(sep + "Input..." + sep + myInput + sep);
myCommand = command.trim();
myInput = input.trim();
mySuccessCode = successCode;
myTimeout = timeout;
}
if ((myOutput != null) && !myOutput.equals(""))
/**
* Description of the Method
*
* @param haystack
* Description of the Parameter
* @param needle
* Description of the Parameter
* @param fromIndex
* Description of the Parameter
* @return Description of the Return Value
*/
private boolean contains(String haystack, String needle, int fromIndex)
{
value.append(sep + "Output..." + sep + myOutput + sep);
return (haystack.trim().toLowerCase().indexOf(needle.trim().toLowerCase(), fromIndex) != -1);
}
if ((myErrors != null) && !myErrors.equals(""))
/**
* Description of the Method
*
* @param value
* Description of the Parameter
* @return Description of the Return Value
*/
public boolean errorsContains(String value)
{
value.append(sep + "Errors..." + sep + myErrors + sep);
return (errorsContains(value, 0));
}
value.append(sep);
if (myInterrupted)
/**
* Description of the Method
*
* @param value
* Description of the Parameter
* @param fromIndex
* Description of the Parameter
* @return Description of the Return Value
*/
public boolean errorsContains(String value, int fromIndex)
{
value.append("Command timed out after " + (myTimeout / 1000)
+ " seconds " + sep);
return (contains(myErrors, value, fromIndex));
}
value.append("Returncode: " + myReturnCode + sep);
if (myError)
/**
* Gets the error attribute of the ExecResults object
*
* @return The error value
*/
public boolean getError()
{
value.append(getErrorMessage() + sep);
return (myError);
}
return (value.toString());
}
/**
* Gets the errorMessage attribute of the ExecResults object
*
* @return The errorMessage value
*/
public String getErrorMessage()
{
switch (getErrorType())
{
case THROWABLE:
return ("Exception: " + myThrowable.getMessage());
case BADRETURNCODE:
return ("Bad return code (expected " + mySuccessCode + ")");
default:
return ("Unknown error");
}
}
/**
* Gets the errorType attribute of the ExecResults object
*
* @return The errorType value
*/
public int getErrorType()
{
return (myErrorType);
}
/**
* Gets the errors attribute of the ExecResults object
*
* @return The errors value
*/
public String getErrors()
{
return (myErrors);
}
/**
* Gets the interrupted attribute of the ExecResults object
*
* @return The interrupted value
*/
public boolean getInterrupted()
{
return (myInterrupted);
}
/**
* Gets the output attribute of the ExecResults object
*
* @return The output value
*/
public String getOutput()
{
return (myOutput);
}
/**
* Gets the returnCode attribute of the ExecResults object
*
* @return The returnCode value
*/
public int getReturnCode()
{
return (myReturnCode);
}
/**
* Gets the throwable attribute of the ExecResults object
*
* @return The throwable value
*/
public Throwable getThrowable()
{
return (myThrowable);
}
/**
* Description of the Method
*
* @param value
* Description of the Parameter
* @return Description of the Return Value
*/
public boolean outputContains(String value)
{
return (outputContains(value, 0));
}
/**
* Description of the Method
*
* @param value
* Description of the Parameter
* @param fromIndex
* Description of the Parameter
* @return Description of the Return Value
*/
public boolean outputContains(String value, int fromIndex)
{
return (contains(myOutput, value, fromIndex));
}
/**
* Sets the error attribute of the ExecResults object
*
* @param value
* The new error value
*/
public void setError(int value)
{
myError = true;
myErrorType = value;
}
/**
* Sets the errors attribute of the ExecResults object
*
* @param errors
* The new errors value
*/
public void setErrors(String errors)
{
myErrors = errors.trim();
}
/**
* Sets the interrupted attribute of the ExecResults object
*/
public void setInterrupted()
{
myInterrupted = true;
}
/**
* Sets the output attribute of the ExecResults object
*
* @param value
* The new output value
*/
public void setOutput(String value)
{
myOutput = value.trim();
}
/**
* Sets the returnCode attribute of the ExecResults object
*
* @param value
* The new returnCode value
*/
public void setReturnCode(int value)
{
myReturnCode = value;
}
/**
* Sets the throwable attribute of the ExecResults object
*
* @param value
* The new throwable value
*/
public void setThrowable(Throwable value)
{
setError(THROWABLE);
myThrowable = value;
}
/**
* Description of the Method
*
* @return Description of the Return Value
*/
public String toString()
{
String sep = System.getProperty("line.separator");
StringBuffer value = new StringBuffer();
value.append("ExecResults for \'" + myCommand + "\'" + sep);
if ((myInput != null) && !myInput.equals(""))
{
value.append(sep + "Input..." + sep + myInput + sep);
}
if ((myOutput != null) && !myOutput.equals(""))
{
value.append(sep + "Output..." + sep + myOutput + sep);
}
if ((myErrors != null) && !myErrors.equals(""))
{
value.append(sep + "Errors..." + sep + myErrors + sep);
}
value.append(sep);
if (myInterrupted)
{
value.append("Command timed out after " + (myTimeout / 1000) + " seconds " + sep);
}
value.append("Returncode: " + myReturnCode + sep);
if (myError)
{
value.append(getErrorMessage() + sep);
}
return (value.toString());
}
}

68
main/project/JavaSource/org/owasp/webgoat/util/ExecutionException.java
View File

@ -1,61 +1,59 @@
package org.owasp.webgoat.util;
/*******************************************************************************
/***************************************************************************************************
*
*
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
* please see http://www.owasp.org/
*
* Copyright (c) 2002 - 2007 Bruce Mayhew
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
* This program is free software; you can redistribute it and/or modify it under the terms of the
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
* You should have received a copy of the GNU General Public License along with this program; if
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
* 02111-1307, USA.
*
* Getting Source ==============
*
* Source for this application is maintained at code.google.com, a repository
* for free software projects.
* Source for this application is maintained at code.google.com, a repository for free software
* projects.
*
* For details, please see http://code.google.com/p/webgoat/
*
*
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
*/
public class ExecutionException extends Exception
{
/**
/**
*
*/
private static final long serialVersionUID = 7282947463831152092L;
/**
* Constructor for the ExecutionException object
*/
public ExecutionException()
{
super();
}
/**
* Constructor for the ExecutionException object
*/
public ExecutionException()
{
super();
}
/**
* Constructor for the ExecutionException object
*
*@param msg Description of the Parameter
*/
public ExecutionException(String msg)
{
super(msg);
}
* Constructor for the ExecutionException object
*
* @param msg
* Description of the Parameter
*/
public ExecutionException(String msg)
{
super(msg);
}
}

382
main/project/JavaSource/org/owasp/webgoat/util/HtmlEncoder.java
View File

@ -1,225 +1,225 @@
package org.owasp.webgoat.util;
import java.util.HashMap;
import java.util.Map;
/*******************************************************************************
/***************************************************************************************************
*
*
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
* please see http://www.owasp.org/
*
* Copyright (c) 2002 - 2007 Bruce Mayhew
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
* This program is free software; you can redistribute it and/or modify it under the terms of the
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
* You should have received a copy of the GNU General Public License along with this program; if
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
* 02111-1307, USA.
*
* Getting Source ==============
*
* Source for this application is maintained at code.google.com, a repository
* for free software projects.
* Source for this application is maintained at code.google.com, a repository for free software
* projects.
*
* For details, please see http://code.google.com/p/webgoat/
*/
public class HtmlEncoder
{
static Map<String, Integer> e2i = new HashMap<String, Integer>();
static Map<String, Integer> e2i = new HashMap<String, Integer>();
static Map<Integer, String> i2e = new HashMap<Integer, String>();
static Map<Integer, String> i2e = new HashMap<Integer, String>();
// html entity list
private static Object[][] entities = { { "quot", new Integer(34) }, // " - double-quote
{ "amp", new Integer(38) }, // & - ampersand
{ "lt", new Integer(60) }, // < - less-than
{ "gt", new Integer(62) }, // > - greater-than
{ "nbsp", new Integer(160) }, // non-breaking space
{ "copy", new Integer(169) }, // <20> - copyright
{ "reg", new Integer(174) }, // <20> - registered trademark
{ "Agrave", new Integer(192) }, // <20> - uppercase A, grave accent
{ "Aacute", new Integer(193) }, // <20> - uppercase A, acute accent
{ "Acirc", new Integer(194) }, // <20> - uppercase A, circumflex accent
{ "Atilde", new Integer(195) }, // <20> - uppercase A, tilde
{ "Auml", new Integer(196) }, // <20> - uppercase A, umlaut
{ "Aring", new Integer(197) }, // <20> - uppercase A, ring
{ "AElig", new Integer(198) }, // <20> - uppercase AE
{ "Ccedil", new Integer(199) }, // <20> - uppercase C, cedilla
{ "Egrave", new Integer(200) }, // <20> - uppercase E, grave accent
{ "Eacute", new Integer(201) }, // <20> - uppercase E, acute accent
{ "Ecirc", new Integer(202) }, // <20> - uppercase E, circumflex accent
{ "Euml", new Integer(203) }, // <20> - uppercase E, umlaut
{ "Igrave", new Integer(204) }, // <20> - uppercase I, grave accent
{ "Iacute", new Integer(205) }, // <20> - uppercase I, acute accent
{ "Icirc", new Integer(206) }, // <20> - uppercase I, circumflex accent
{ "Iuml", new Integer(207) }, // <20> - uppercase I, umlaut
{ "ETH", new Integer(208) }, // <20> - uppercase Eth, Icelandic
{ "Ntilde", new Integer(209) }, // <20> - uppercase N, tilde
{ "Ograve", new Integer(210) }, // <20> - uppercase O, grave accent
{ "Oacute", new Integer(211) }, // <20> - uppercase O, acute accent
{ "Ocirc", new Integer(212) }, // <20> - uppercase O, circumflex accent
{ "Otilde", new Integer(213) }, // <20> - uppercase O, tilde
{ "Ouml", new Integer(214) }, // <20> - uppercase O, umlaut
{ "Oslash", new Integer(216) }, // <20> - uppercase O, slash
{ "Ugrave", new Integer(217) }, // <20> - uppercase U, grave accent
{ "Uacute", new Integer(218) }, // <20> - uppercase U, acute accent
{ "Ucirc", new Integer(219) }, // <20> - uppercase U, circumflex accent
{ "Uuml", new Integer(220) }, // <20> - uppercase U, umlaut
{ "Yacute", new Integer(221) }, // <20> - uppercase Y, acute accent
{ "THORN", new Integer(222) }, // <20> - uppercase THORN, Icelandic
{ "szlig", new Integer(223) }, // <20> - lowercase sharps, German
{ "agrave", new Integer(224) }, // <20> - lowercase a, grave accent
{ "aacute", new Integer(225) }, // <20> - lowercase a, acute accent
{ "acirc", new Integer(226) }, // <20> - lowercase a, circumflex accent
{ "atilde", new Integer(227) }, // <20> - lowercase a, tilde
{ "auml", new Integer(228) }, // <20> - lowercase a, umlaut
{ "aring", new Integer(229) }, // <20> - lowercase a, ring
{ "aelig", new Integer(230) }, // <20> - lowercase ae
{ "ccedil", new Integer(231) }, // <20> - lowercase c, cedilla
{ "egrave", new Integer(232) }, // <20> - lowercase e, grave accent
{ "eacute", new Integer(233) }, // <20> - lowercase e, acute accent
{ "ecirc", new Integer(234) }, // <20> - lowercase e, circumflex accent
{ "euml", new Integer(235) }, // <20> - lowercase e, umlaut
{ "igrave", new Integer(236) }, // <20> - lowercase i, grave accent
{ "iacute", new Integer(237) }, // <20> - lowercase i, acute accent
{ "icirc", new Integer(238) }, // <20> - lowercase i, circumflex accent
{ "iuml", new Integer(239) }, // <20> - lowercase i, umlaut
{ "igrave", new Integer(236) }, // <20> - lowercase i, grave accent
{ "iacute", new Integer(237) }, // <20> - lowercase i, acute accent
{ "icirc", new Integer(238) }, // <20> - lowercase i, circumflex accent
{ "iuml", new Integer(239) }, // <20> - lowercase i, umlaut
{ "eth", new Integer(240) }, // <20> - lowercase eth, Icelandic
{ "ntilde", new Integer(241) }, // <20> - lowercase n, tilde
{ "ograve", new Integer(242) }, // <20> - lowercase o, grave accent
{ "oacute", new Integer(243) }, // <20> - lowercase o, acute accent
{ "ocirc", new Integer(244) }, // <20> - lowercase o, circumflex accent
{ "otilde", new Integer(245) }, // <20> - lowercase o, tilde
{ "ouml", new Integer(246) }, // <20> - lowercase o, umlaut
{ "oslash", new Integer(248) }, // <20> - lowercase o, slash
{ "ugrave", new Integer(249) }, // <20> - lowercase u, grave accent
{ "uacute", new Integer(250) }, // <20> - lowercase u, acute accent
{ "ucirc", new Integer(251) }, // <20> - lowercase u, circumflex accent
{ "uuml", new Integer(252) }, // <20> - lowercase u, umlaut
{ "yacute", new Integer(253) }, // <20> - lowercase y, acute accent
{ "thorn", new Integer(254) }, // <20> - lowercase thorn, Icelandic
{ "yuml", new Integer(255) }, // <20> - lowercase y, umlaut
{ "euro", new Integer(8364) },// Euro symbol
};
// html entity list
private static Object[][] entities = { { "quot", new Integer(34) }, // " - double-quote
{ "amp", new Integer(38) }, // & - ampersand
{ "lt", new Integer(60) }, // < - less-than
{ "gt", new Integer(62) }, // > - greater-than
{ "nbsp", new Integer(160) }, // non-breaking space
{ "copy", new Integer(169) }, // <20> - copyright
{ "reg", new Integer(174) }, // <20> - registered trademark
{ "Agrave", new Integer(192) }, // <20> - uppercase A, grave accent
{ "Aacute", new Integer(193) }, // <20> - uppercase A, acute accent
{ "Acirc", new Integer(194) }, // <20> - uppercase A, circumflex accent
{ "Atilde", new Integer(195) }, // <20> - uppercase A, tilde
{ "Auml", new Integer(196) }, // <20> - uppercase A, umlaut
{ "Aring", new Integer(197) }, // <20> - uppercase A, ring
{ "AElig", new Integer(198) }, // <20> - uppercase AE
{ "Ccedil", new Integer(199) }, // <20> - uppercase C, cedilla
{ "Egrave", new Integer(200) }, // <20> - uppercase E, grave accent
{ "Eacute", new Integer(201) }, // <20> - uppercase E, acute accent
{ "Ecirc", new Integer(202) }, // <20> - uppercase E, circumflex accent
{ "Euml", new Integer(203) }, // <20> - uppercase E, umlaut
{ "Igrave", new Integer(204) }, // <20> - uppercase I, grave accent
{ "Iacute", new Integer(205) }, // <20> - uppercase I, acute accent
{ "Icirc", new Integer(206) }, // <20> - uppercase I, circumflex accent
{ "Iuml", new Integer(207) }, // <20> - uppercase I, umlaut
{ "ETH", new Integer(208) }, // <20> - uppercase Eth, Icelandic
{ "Ntilde", new Integer(209) }, // <20> - uppercase N, tilde
{ "Ograve", new Integer(210) }, // <20> - uppercase O, grave accent
{ "Oacute", new Integer(211) }, // <20> - uppercase O, acute accent
{ "Ocirc", new Integer(212) }, // <20> - uppercase O, circumflex accent
{ "Otilde", new Integer(213) }, // <20> - uppercase O, tilde
{ "Ouml", new Integer(214) }, // <20> - uppercase O, umlaut
{ "Oslash", new Integer(216) }, // <20> - uppercase O, slash
{ "Ugrave", new Integer(217) }, // <20> - uppercase U, grave accent
{ "Uacute", new Integer(218) }, // <20> - uppercase U, acute accent
{ "Ucirc", new Integer(219) }, // <20> - uppercase U, circumflex accent
{ "Uuml", new Integer(220) }, // <20> - uppercase U, umlaut
{ "Yacute", new Integer(221) }, // <20> - uppercase Y, acute accent
{ "THORN", new Integer(222) }, // <20> - uppercase THORN, Icelandic
{ "szlig", new Integer(223) }, // <20> - lowercase sharps, German
{ "agrave", new Integer(224) }, // <20> - lowercase a, grave accent
{ "aacute", new Integer(225) }, // <20> - lowercase a, acute accent
{ "acirc", new Integer(226) }, // <20> - lowercase a, circumflex accent
{ "atilde", new Integer(227) }, // <20> - lowercase a, tilde
{ "auml", new Integer(228) }, // <20> - lowercase a, umlaut
{ "aring", new Integer(229) }, // <20> - lowercase a, ring
{ "aelig", new Integer(230) }, // <20> - lowercase ae
{ "ccedil", new Integer(231) }, // <20> - lowercase c, cedilla
{ "egrave", new Integer(232) }, // <20> - lowercase e, grave accent
{ "eacute", new Integer(233) }, // <20> - lowercase e, acute accent
{ "ecirc", new Integer(234) }, // <20> - lowercase e, circumflex accent
{ "euml", new Integer(235) }, // <20> - lowercase e, umlaut
{ "igrave", new Integer(236) }, // <20> - lowercase i, grave accent
{ "iacute", new Integer(237) }, // <20> - lowercase i, acute accent
{ "icirc", new Integer(238) }, // <20> - lowercase i, circumflex accent
{ "iuml", new Integer(239) }, // <20> - lowercase i, umlaut
{ "igrave", new Integer(236) }, // <20> - lowercase i, grave accent
{ "iacute", new Integer(237) }, // <20> - lowercase i, acute accent
{ "icirc", new Integer(238) }, // <20> - lowercase i, circumflex accent
{ "iuml", new Integer(239) }, // <20> - lowercase i, umlaut
{ "eth", new Integer(240) }, // <20> - lowercase eth, Icelandic
{ "ntilde", new Integer(241) }, // <20> - lowercase n, tilde
{ "ograve", new Integer(242) }, // <20> - lowercase o, grave accent
{ "oacute", new Integer(243) }, // <20> - lowercase o, acute accent
{ "ocirc", new Integer(244) }, // <20> - lowercase o, circumflex accent
{ "otilde", new Integer(245) }, // <20> - lowercase o, tilde
{ "ouml", new Integer(246) }, // <20> - lowercase o, umlaut
{ "oslash", new Integer(248) }, // <20> - lowercase o, slash
{ "ugrave", new Integer(249) }, // <20> - lowercase u, grave accent
{ "uacute", new Integer(250) }, // <20> - lowercase u, acute accent
{ "ucirc", new Integer(251) }, // <20> - lowercase u, circumflex accent
{ "uuml", new Integer(252) }, // <20> - lowercase u, umlaut
{ "yacute", new Integer(253) }, // <20> - lowercase y, acute accent
{ "thorn", new Integer(254) }, // <20> - lowercase thorn, Icelandic
{ "yuml", new Integer(255) }, // <20> - lowercase y, umlaut
{ "euro", new Integer(8364) },// Euro symbol
};
public HtmlEncoder()
{
for (int i = 0; i < entities.length; i++)
e2i.put((String)entities[i][0], (Integer)entities[i][1]);
for (int i = 0; i < entities.length; i++)
i2e.put((Integer)entities[i][1], (String)entities[i][0]);
}
/**
* Turns funky characters into HTML entity equivalents<p>
*
* e.g. <tt>"bread" & "butter"</tt> => <tt>&amp;quot;bread&amp;quot; &amp;amp;
* &amp;quot;butter&amp;quot;</tt> . Update: supports nearly all HTML entities, including funky
* accents. See the source code for more detail. Adapted from
* http://www.purpletech.com/code/src/com/purpletech/util/Utils.java.
*
* @param s1 Description of the Parameter
* @return Description of the Return Value
*/
public static String encode(String s1)
{
StringBuffer buf = new StringBuffer();
int i;
for (i = 0; i < s1.length(); ++i)
public HtmlEncoder()
{
char ch = s1.charAt(i);
String entity = i2e.get(new Integer((int) ch));
if (entity == null)
{
if (((int) ch) > 128)
{
buf.append("&#" + ((int) ch) + ";");
}
else
{
buf.append(ch);
}
}
else
{
buf.append("&" + entity + ";");
}
for (int i = 0; i < entities.length; i++)
e2i.put((String) entities[i][0], (Integer) entities[i][1]);
for (int i = 0; i < entities.length; i++)
i2e.put((Integer) entities[i][1], (String) entities[i][0]);
}
return buf.toString();
}
/**
* Given a string containing entity escapes, returns a string containing the actual Unicode
* characters corresponding to the escapes. Adapted from
* http://www.purpletech.com/code/src/com/purpletech/util/Utils.java.
*
* @param s1 Description of the Parameter
* @return Description of the Return Value
*/
public static String decode(String s1)
{
StringBuffer buf = new StringBuffer();
int i;
for (i = 0; i < s1.length(); ++i)
/**
* Turns funky characters into HTML entity equivalents
* <p>
*
* e.g. <tt>"bread" & "butter"</tt> => <tt>&amp;quot;bread&amp;quot; &amp;amp;
* &amp;quot;butter&amp;quot;</tt> .
* Update: supports nearly all HTML entities, including funky accents. See the source code for
* more detail. Adapted from http://www.purpletech.com/code/src/com/purpletech/util/Utils.java.
*
* @param s1
* Description of the Parameter
* @return Description of the Return Value
*/
public static String encode(String s1)
{
char ch = s1.charAt(i);
StringBuffer buf = new StringBuffer();
if (ch == '&')
{
int semi = s1.indexOf(';', i + 1);
if (semi == -1)
int i;
for (i = 0; i < s1.length(); ++i)
{
buf.append(ch);
continue;
char ch = s1.charAt(i);
String entity = i2e.get(new Integer((int) ch));
if (entity == null)
{
if (((int) ch) > 128)
{
buf.append("&#" + ((int) ch) + ";");
}
else
{
buf.append(ch);
}
}
else
{
buf.append("&" + entity + ";");
}
}
String entity = s1.substring(i + 1, semi);
Integer iso;
if (entity.charAt(0) == '#')
{
iso = new Integer(entity.substring(1));
}
else
{
iso = e2i.get(entity);
}
if (iso == null)
{
buf.append("&" + entity + ";");
}
else
{
buf.append((char) (iso.intValue()));
}
i = semi;
}
else
{
buf.append(ch);
}
return buf.toString();
}
return buf.toString();
}
/**
* Given a string containing entity escapes, returns a string containing the actual Unicode
* characters corresponding to the escapes. Adapted from
* http://www.purpletech.com/code/src/com/purpletech/util/Utils.java.
*
* @param s1
* Description of the Parameter
* @return Description of the Return Value
*/
public static String decode(String s1)
{
StringBuffer buf = new StringBuffer();
int i;
for (i = 0; i < s1.length(); ++i)
{
char ch = s1.charAt(i);
if (ch == '&')
{
int semi = s1.indexOf(';', i + 1);
if (semi == -1)
{
buf.append(ch);
continue;
}
String entity = s1.substring(i + 1, semi);
Integer iso;
if (entity.charAt(0) == '#')
{
iso = new Integer(entity.substring(1));
}
else
{
iso = e2i.get(entity);
}
if (iso == null)
{
buf.append("&" + entity + ";");
}
else
{
buf.append((char) (iso.intValue()));
}
i = semi;
}
else
{
buf.append(ch);
}
}
return buf.toString();
}
}

198
main/project/JavaSource/org/owasp/webgoat/util/Interceptor.java
View File

@ -1,6 +1,7 @@
/**
*
*/
package org.owasp.webgoat.util;
import java.io.IOException;
@ -8,9 +9,7 @@ import java.io.BufferedReader;
import java.io.PrintWriter;
import java.io.InputStreamReader;
import java.net.UnknownHostException;
import java.net.Socket;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
@ -20,134 +19,127 @@ import javax.servlet.ServletResponse;
import javax.servlet.RequestDispatcher;
import javax.servlet.http.HttpServletRequest;
/*******************************************************************************
/***************************************************************************************************
*
*
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
* please see http://www.owasp.org/
*
* Copyright (c) 2002 - 2007 Bruce Mayhew
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
* This program is free software; you can redistribute it and/or modify it under the terms of the
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
* You should have received a copy of the GNU General Public License along with this program; if
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
* 02111-1307, USA.
*
* Getting Source ==============
*
* Source for this application is maintained at code.google.com, a repository
* for free software projects.
* Source for this application is maintained at code.google.com, a repository for free software
* projects.
*
* For details, please see http://code.google.com/p/webgoat/
*
*
* @author sherif koussa - Macadamian Technologies
*
*
*/
public class Interceptor implements Filter
{
private static final String OSG_SERVER_NAME = "OSGServerName";
private static final String OSG_SERVER_NAME = "OSGServerName";
private static final String OSG_SERVER_PORT = "OSGServerPort";
private static final String OSG_SERVER_PORT = "OSGServerPort";
/* (non-Javadoc)
* @see javax.servlet.Filter#destroy()
*/
public void destroy()
{
// TODO Auto-generated method stub
}
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException
{
HttpServletRequest req = (HttpServletRequest) request;
Socket osgSocket = null;
PrintWriter out = null;
BufferedReader in = null;
String osgServerName = req.getSession().getServletContext()
.getInitParameter(OSG_SERVER_NAME);
String osgServerPort = req.getSession().getServletContext()
.getInitParameter(OSG_SERVER_PORT);
try
/*
* (non-Javadoc)
*
* @see javax.servlet.Filter#destroy()
*/
public void destroy()
{
//If these parameters are not defined then no communication will happen with OSG
if (osgServerName != null && osgServerName.length() != 0
&& osgServerPort != null && osgServerPort.length() != 0)
{
osgSocket = new Socket(osgServerName, Integer
.parseInt(osgServerPort));
if (osgSocket != null)
// TODO Auto-generated method stub
}
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException,
ServletException
{
HttpServletRequest req = (HttpServletRequest) request;
Socket osgSocket = null;
PrintWriter out = null;
BufferedReader in = null;
String osgServerName = req.getSession().getServletContext().getInitParameter(OSG_SERVER_NAME);
String osgServerPort = req.getSession().getServletContext().getInitParameter(OSG_SERVER_PORT);
try
{
out = new PrintWriter(osgSocket.getOutputStream(), true);
in = new BufferedReader(new InputStreamReader(osgSocket
.getInputStream()));
//String message = "HTTPRECEIVEHTTPREQUEST,-,DataValidation_SqlInjection_Basic.aspx";
//out.println(message);
// If these parameters are not defined then no communication will happen with OSG
if (osgServerName != null && osgServerName.length() != 0 && osgServerPort != null
&& osgServerPort.length() != 0)
{
osgSocket = new Socket(osgServerName, Integer.parseInt(osgServerPort));
if (osgSocket != null)
{
out = new PrintWriter(osgSocket.getOutputStream(), true);
in = new BufferedReader(new InputStreamReader(osgSocket.getInputStream()));
// String message =
// "HTTPRECEIVEHTTPREQUEST,-,DataValidation_SqlInjection_Basic.aspx";
// out.println(message);
//System.out.println(in.readLine());
// System.out.println(in.readLine());
}
}
} catch (UnknownHostException e)
{
e.printStackTrace();
} catch (IOException e)
{
e.printStackTrace();
} finally
{
if (out != null)
{
out.close();
}
if (in != null)
{
in.close();
}
if (osgSocket != null)
{
osgSocket.close();
}
}
}
String url = req.getRequestURL().toString();
RequestDispatcher disp = req.getRequestDispatcher(url.substring(url.lastIndexOf("WebGoat/")
+ "WebGoat".length()));
disp.forward(request, response);
}
catch (UnknownHostException e)
/*
* (non-Javadoc)
*
* @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
*/
public void init(FilterConfig arg0) throws ServletException
{
e.printStackTrace();
// TODO Auto-generated method stub
}
catch (IOException e)
{
e.printStackTrace();
}
finally
{
if (out != null)
{
out.close();
}
if (in != null)
{
in.close();
}
if (osgSocket != null)
{
osgSocket.close();
}
}
String url = req.getRequestURL().toString();
RequestDispatcher disp = req.getRequestDispatcher(url.substring(url
.lastIndexOf("WebGoat/")
+ "WebGoat".length()));
disp.forward(request, response);
}
/* (non-Javadoc)
* @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
*/
public void init(FilterConfig arg0) throws ServletException
{
// TODO Auto-generated method stub
}
}

156
main/project/JavaSource/org/owasp/webgoat/util/ThreadWatcher.java
View File

@ -1,117 +1,103 @@
package org.owasp.webgoat.util;
import java.util.BitSet;
/*******************************************************************************
/***************************************************************************************************
*
*
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
* please see http://www.owasp.org/
*
* Copyright (c) 2002 - 2007 Bruce Mayhew
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
* This program is free software; you can redistribute it and/or modify it under the terms of the
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
* You should have received a copy of the GNU General Public License along with this program; if
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
* 02111-1307, USA.
*
* Getting Source ==============
*
* Source for this application is maintained at code.google.com, a repository
* for free software projects.
* Source for this application is maintained at code.google.com, a repository for free software
* projects.
*
* For details, please see http://code.google.com/p/webgoat/
*
*@author jwilliams@aspectsecurity.com
*@created November 6, 2002
*
* @author jwilliams@aspectsecurity.com
* @created November 6, 2002
*/
public class ThreadWatcher implements Runnable
{
// time to live in milliseconds
private BitSet myInterrupted;
// time to live in milliseconds
private BitSet myInterrupted;
private Process myProcess;
private Process myProcess;
private int myTimeout;
private int myTimeout;
/**
* Constructor for the ThreadWatcher object
*
* @param p
* Description of the Parameter
* @param interrupted
* Description of the Parameter
* @param timeout
* Description of the Parameter
*/
public ThreadWatcher(Process p, BitSet interrupted, int timeout)
{
myProcess = p;
/**
* Constructor for the ThreadWatcher object
*
*@param p Description of the Parameter
*@param interrupted Description of the Parameter
*@param timeout Description of the Parameter
*/
public ThreadWatcher(Process p, BitSet interrupted, int timeout)
{
myProcess = p;
// thread used by whoever constructed this watcher
myTimeout = timeout;
myInterrupted = interrupted;
}
/*
* Interrupt the thread by marking the interrupted bit and killing the process
*/
/**
* Description of the Method
*/
public void interrupt()
{
myInterrupted.set(0);
// set interrupted bit (bit 0 of the bitset) to 1
myProcess.destroy();
// thread used by whoever constructed this watcher
myTimeout = timeout;
myInterrupted = interrupted;
}
/*
* try
* {
* myProcess.getInputStream().close();
* }
* catch( IOException e1 )
* {
* / do nothing -- input streams are probably already closed
* }
* try
* {
* myProcess.getErrorStream().close();
* }
* catch( IOException e2 )
* {
* / do nothing -- input streams are probably already closed
* }
* myThread.interrupt();
* Interrupt the thread by marking the interrupted bit and killing the process
*/
}
/**
* Description of the Method
*/
public void interrupt()
{
myInterrupted.set(0);
/**
* Main processing method for the ThreadWatcher object
*/
public void run()
{
try
{
Thread.sleep(myTimeout);
}
catch (InterruptedException e)
{
// do nothing -- if watcher is interrupted, so is thread
// set interrupted bit (bit 0 of the bitset) to 1
myProcess.destroy();
/*
* try { myProcess.getInputStream().close(); } catch( IOException e1 ) { / do nothing --
* input streams are probably already closed } try { myProcess.getErrorStream().close(); }
* catch( IOException e2 ) { / do nothing -- input streams are probably already closed }
* myThread.interrupt();
*/
}
interrupt();
}
/**
* Main processing method for the ThreadWatcher object
*/
public void run()
{
try
{
Thread.sleep(myTimeout);
} catch (InterruptedException e)
{
// do nothing -- if watcher is interrupted, so is thread
}
interrupt();
}
}