feat: show directly requested file in requests overview

When a call directly hits a file it is now show up in the requests overview. This helps the user whether an attack from WebGoat actually requested the uploaded file.

Closes: gh-1551
This commit is contained in:
Nanne Baars
2023-12-04 21:34:16 +01:00
parent 3d651526be
commit ae261f201a
3 changed files with 81 additions and 20 deletions

View File

@ -0,0 +1,41 @@
package org.owasp.webgoat.webwolf.requests;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;
import java.net.URI;
import org.assertj.core.api.Assertions;
import org.junit.jupiter.api.DisplayName;
import org.junit.jupiter.api.Test;
import org.springframework.boot.actuate.web.exchanges.HttpExchange;
class WebWolfTraceRepositoryTest {
@Test
@DisplayName("When a user hits a file upload it should be recorded")
void shouldAddFilesRequest() {
HttpExchange httpExchange = mock();
HttpExchange.Request request = mock();
when(httpExchange.getRequest()).thenReturn(request);
when(request.getUri()).thenReturn(URI.create("http://localhost:9090/files/test1234/test.jpg"));
WebWolfTraceRepository repository = new WebWolfTraceRepository();
repository.add(httpExchange);
Assertions.assertThat(repository.findAll()).hasSize(1);
}
@Test
@DisplayName("When a user hits file upload page ('/files') it should be recorded")
void shouldAddNotAddFilesRequestOverview() {
HttpExchange httpExchange = mock();
HttpExchange.Request request = mock();
when(httpExchange.getRequest()).thenReturn(request);
when(request.getUri()).thenReturn(URI.create("http://localhost:9090/files"));
WebWolfTraceRepository repository = new WebWolfTraceRepository();
repository.add(httpExchange);
Assertions.assertThat(repository.findAll()).hasSize(0);
}
}