Miscellaneous bug fixes

divide by zero, inaccurate discount and totals, reflection of user input


git-svn-id: http://webgoat.googlecode.com/svn/trunk/webgoat@273 4033779f-a91e-0410-96ef-6bf7bf53c507

main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java

@@ -0,0 +1,306 @@
+package org.owasp.webgoat.lessons.CrossSiteScripting;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.ecs.ElementContainer;
+import org.owasp.webgoat.lessons.Category;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.DeleteProfile;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.GoatHillsFinancial;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.LessonAction;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.ListStaff;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.Login;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.Logout;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.SearchStaff;
+import org.owasp.webgoat.session.ParameterNotFoundException;
+import org.owasp.webgoat.session.UnauthenticatedException;
+import org.owasp.webgoat.session.UnauthorizedException;
+import org.owasp.webgoat.session.ValidationException;
+import org.owasp.webgoat.session.WebSession;
+import org.owasp.webgoat.util.HtmlEncoder;
+
+/**
+ /*******************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ * 
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at code.google.com, a repository
+ * for free software projects.
+ * 
+ * For details, please see http://code.google.com/p/webgoat/
+ *
+ */
+public class CrossSiteScripting extends GoatHillsFinancial
+{
+    private final static Integer DEFAULT_RANKING = new Integer(100);
+
+    public final static String STAGE1 = "Stored XSS";
+    
+    public final static String STAGE2 = "Block Stored XSS using Input Validation";
+    
+    public final static String STAGE3 = "Stored XSS Revisited";
+    
+    public final static String STAGE4 = "Block Stored XSS using Output Encoding";
+    
+    public final static String STAGE5 = "Reflected XSS";
+    
+    public final static String STAGE6 = "Block Reflected XSS";
+    
+    protected void registerActions(String className)
+    {
+	registerAction(new ListStaff(this, className, LISTSTAFF_ACTION));
+	registerAction(new SearchStaff(this, className, SEARCHSTAFF_ACTION));
+	registerAction(new ViewProfile(this, className, VIEWPROFILE_ACTION));
+	registerAction(new EditProfile(this, className, EDITPROFILE_ACTION));
+	registerAction(new EditProfile(this, className, CREATEPROFILE_ACTION));
+
+	// These actions are special in that they chain to other actions.
+	registerAction(new Login(this, className, LOGIN_ACTION,
+		getAction(LISTSTAFF_ACTION)));
+	registerAction(new Logout(this, className, LOGOUT_ACTION,
+		getAction(LOGIN_ACTION)));
+	registerAction(new FindProfile(this, className, FINDPROFILE_ACTION,
+		getAction(VIEWPROFILE_ACTION)));
+	registerAction(new UpdateProfile(this, className,
+		UPDATEPROFILE_ACTION, getAction(VIEWPROFILE_ACTION)));
+	registerAction(new DeleteProfile(this, className,
+		DELETEPROFILE_ACTION, getAction(LISTSTAFF_ACTION)));
+    }
+
+    /**
+     *  Gets the category attribute of the CrossSiteScripting object
+     *
+     * @return    The category value
+     */
+    public Category getDefaultCategory()
+    {
+	return Category.XSS;
+    }
+
+    /**
+     *  Gets the hints attribute of the DirectoryScreen object
+     *
+     * @return    The hints value
+     */
+    protected List<String> getHints(WebSession s)
+    {
+	List<String> hints = new ArrayList<String>();
+
+	// Stage 1
+	hints.add("You can put HTML tags in form input fields.");
+	hints
+		.add("Bury a SCRIPT tag in the field to attack anyone who reads it.");
+	hints
+		.add("Enter this: &lt;script language=\"javascript\" type=\"text/javascript\"&gt;alert(\"Ha Ha Ha\");&lt;/script&gt; in message fields.");
+	hints
+		.add("Enter this: &lt;script&gtalert(\"document.cookie\");&lt;/script&gt; in message fields.");
+
+	// Stage 2
+	hints
+		.add("Many scripts rely on the use of special characters such as: &lt;");
+	hints
+		.add("Allowing only a certain set of characters (positive filtering) is preferred to blocking a set of characters (negative filtering).");
+	hints
+		.add("The java.util.regex package is useful for filtering string values.");
+
+	// Stage 3
+	hints
+		.add("Browsers recognize and decode HTML entity encoded content after parsing and interpretting HTML tags.");
+	hints
+		.add("An HTML entity encoder is provided in the ParameterParser class.");
+
+	// Stage 4
+	hints
+		.add("Examine content served in response to form submissions looking for data taken from the form.");
+
+	// Stage 5
+	hints
+		.add("Validate early.  Consider: out.println(\"Order for \" + request.getParameter(\"product\") + \" being processed...\");");
+
+	return hints;
+    }
+
+
+    /**
+     *  Gets the instructions attribute of the ParameterInjection object
+     *
+     * @return    The instructions value
+     */
+    public String getInstructions(WebSession s)
+    {
+	String instructions = "";
+
+	if (!getLessonTracker(s).getCompleted())
+	{
+		String stage = getStage(s);
+		if (STAGE1.equals(stage))
+	    {
+		    instructions = "Stage 1: Execute a Stored Cross Site Scripting (XSS) attack.<br>"
+			    + "As 'Tom', execute a Stored XSS attack against the Street field on the Edit Profile page.  "
+			    + "Verify that 'Jerry' is affected by the attack.";
+	    }
+		else if (STAGE2.equals(stage))
+		{
+		    instructions = "Stage 2: Block Stored XSS using Input Validation.<br>"
+			    + "Implement a fix to block the stored XSS before it can be written to the database. "
+			    + "Repeat stage 1 as 'Eric' with 'David' as the manager.  Verify that 'David' is not affected by the attack.";
+		}
+		else if (STAGE3.equals(stage))
+		{
+		    instructions = "Stage 3: Execute a previously Stored Cross Site Scripting (XSS) attack.<br>"
+			    + "The 'Bruce' employee profile is pre-loaded with a stored XSS attack. "
+			    + "Verify that 'David' is affected by the attack even though the fix from stage 2 is in place.";
+		}
+		else if (STAGE4.equals(stage))
+		{
+		    instructions = "Stage 4: Block Stored XSS using Output Encoding.<br>"
+			    + "Implement a fix to block XSS after it is read from the database. "
+			    + "Repeat stage 3. Verify that 'David' is not affected by Bruce's profile attack.";
+		}
+		else if (STAGE5.equals(stage))
+		{
+		    instructions = "Stage 5: Execute a Reflected XSS attack.<br>"
+			    + "Use a vulnerability on the Search Staff page to craft a URL containing a reflected XSS attack.  "
+			    + "Verify that another employee using the link is affected by the attack.";
+		}
+		else if (STAGE6.equals(stage))
+		{
+		    instructions = "Stage 6: Block Reflected XSS using Input Validation.<br>"
+			    + "Implement a fix to block this reflected XSS attack. "
+			    + "Repeat step 5.  Verify that the attack URL is no longer effective.";
+	    }
+	}
+
+	return instructions;
+
+    }
+
+    @Override
+	public String[] getStages() {
+    	if (getWebgoatContext().isCodingExercises())
+    		return new String[] {STAGE1, STAGE2, STAGE3, STAGE4, STAGE5, STAGE6};
+    	return new String[] {STAGE1, STAGE3, STAGE5};
+	}
+
+    public void handleRequest(WebSession s)
+    {
+	if (s.getLessonSession(this) == null)
+	    s.openLessonSession(this);
+
+	String requestedActionName = null;
+	try
+	{
+	    requestedActionName = s.getParser().getStringParameter("action");
+	}
+	catch (ParameterNotFoundException pnfe)
+	{
+	    // Let them eat login page.
+	    requestedActionName = LOGIN_ACTION;
+	}
+
+	if (requestedActionName != null)
+	{
+	    try
+	    {
+		LessonAction action = getAction(requestedActionName);
+
+		if (action != null)
+		{
+		    if (!action.requiresAuthentication()
+			    || action.isAuthenticated(s))
+		    {
+			action.handleRequest(s);
+			//setCurrentAction(s, action.getNextPage(s));
+		    }
+		}
+		else
+		{
+		    setCurrentAction(s, ERROR_ACTION);
+		}
+	    }
+	    catch (ParameterNotFoundException pnfe)
+	    {
+		System.out.println("Missing parameter");
+		pnfe.printStackTrace();
+		setCurrentAction(s, ERROR_ACTION);
+	    }
+	    catch (ValidationException ve)
+	    {
+		System.out.println("Validation failed");
+		ve.printStackTrace();
+		setCurrentAction(s, ERROR_ACTION);
+	    }
+	    catch (UnauthenticatedException ue)
+	    {
+		s.setMessage("Login failed");
+		System.out.println("Authentication failure");
+		ue.printStackTrace();
+	    }
+	    catch (UnauthorizedException ue2)
+	    {
+		s.setMessage("You are not authorized to perform this function");
+		System.out.println("Authorization failure");
+		ue2.printStackTrace();
+	    }
+	    catch (Exception e)
+	    {
+		// All other errors send the user to the generic error page
+		System.out.println("handleRequest() error");
+		e.printStackTrace();
+		setCurrentAction(s, ERROR_ACTION);
+	    }
+	}
+
+	// All this does for this lesson is ensure that a non-null content exists.
+	setContent(new ElementContainer());
+    }
+
+    protected Integer getDefaultRanking()
+    {
+	return DEFAULT_RANKING;
+    }
+
+
+    /**
+     *  Gets the title attribute of the CrossSiteScripting object
+     *
+     * @return    The title value
+     */
+    public String getTitle()
+    {
+	return "LAB: Cross Site Scripting";
+    }
+
+	public String htmlEncode(WebSession s, String text)
+	{
+		if (STAGE4.equals(getStage(s)) && 
+				text.indexOf("<script>") > -1 && text.indexOf("alert") > -1 && text.indexOf("</script>") > -1)
+		{
+			setStageComplete(s, STAGE4);
+			s.setMessage( "Welcome to stage 5 -- exploiting the data layer" );
+		}
+		
+		return HtmlEncoder.encode(text);
+	}
+
+}

main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/EditProfile.java

@@ -0,0 +1,195 @@
+package org.owasp.webgoat.lessons.CrossSiteScripting;
+
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+
+import org.owasp.webgoat.lessons.GoatHillsFinancial.DefaultLessonAction;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.GoatHillsFinancial;
+import org.owasp.webgoat.session.Employee;
+import org.owasp.webgoat.session.ParameterNotFoundException;
+import org.owasp.webgoat.session.UnauthenticatedException;
+import org.owasp.webgoat.session.UnauthorizedException;
+import org.owasp.webgoat.session.WebSession;
+
+/*******************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ * 
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at code.google.com, a repository
+ * for free software projects.
+ * 
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+public class EditProfile extends DefaultLessonAction
+{
+
+    public EditProfile(GoatHillsFinancial lesson, String lessonName,
+	    String actionName)
+    {
+	super(lesson, lessonName, actionName);
+    }
+
+
+    public void handleRequest(WebSession s) throws ParameterNotFoundException,
+	    UnauthenticatedException, UnauthorizedException
+    {
+	getLesson().setCurrentAction(s, getActionName());
+
+	if (isAuthenticated(s))
+	{
+	    int userId = getUserId(s);
+	    int employeeId = s.getParser().getIntParameter(
+		    CrossSiteScripting.EMPLOYEE_ID);
+
+	    Employee employee = getEmployeeProfile(s, userId, employeeId);
+	    setSessionAttribute(s, getLessonName() + "."
+		    + CrossSiteScripting.EMPLOYEE_ATTRIBUTE_KEY, employee);
+	}
+	else
+	    throw new UnauthenticatedException();
+    }
+
+
+    public String getNextPage(WebSession s)
+    {
+	return CrossSiteScripting.EDITPROFILE_ACTION;
+    }
+
+
+    public Employee getEmployeeProfile(WebSession s, int userId,
+	    int subjectUserId) throws UnauthorizedException
+    {
+	Employee profile = null;
+
+	// Query the database for the profile data of the given employee
+	try
+	{
+	    String query = "SELECT * FROM employee WHERE userid = ?";
+
+	    try
+	    {
+		PreparedStatement answer_statement = WebSession
+			.getConnection(s).prepareStatement(query,
+				ResultSet.TYPE_SCROLL_INSENSITIVE,
+				ResultSet.CONCUR_READ_ONLY);
+		answer_statement.setInt(1, subjectUserId);
+		ResultSet answer_results = answer_statement.executeQuery();
+		if (answer_results.next())
+		{
+		    // Note: Do NOT get the password field.
+		    profile = new Employee(answer_results.getInt("userid"),
+			    answer_results.getString("first_name"),
+			    answer_results.getString("last_name"),
+			    answer_results.getString("ssn"), answer_results
+				    .getString("title"), answer_results
+				    .getString("phone"), answer_results
+				    .getString("address1"), answer_results
+				    .getString("address2"), answer_results
+				    .getInt("manager"), answer_results
+				    .getString("start_date"), answer_results
+				    .getInt("salary"), answer_results
+				    .getString("ccn"), answer_results
+				    .getInt("ccn_limit"), answer_results
+				    .getString("disciplined_date"),
+			    answer_results.getString("disciplined_notes"),
+			    answer_results.getString("personal_description"));
+		    /*					System.out.println("Retrieved employee from db: " + 
+		     profile.getFirstName() + " " + profile.getLastName() + 
+		     " (" + profile.getId() + ")");
+		     */}
+	    }
+	    catch (SQLException sqle)
+	    {
+		s.setMessage("Error getting employee profile");
+		sqle.printStackTrace();
+	    }
+	}
+	catch (Exception e)
+	{
+	    s.setMessage("Error getting employee profile");
+	    e.printStackTrace();
+	}
+
+	return profile;
+    }
+
+
+    public Employee getEmployeeProfile_BACKUP(WebSession s, int userId,
+	    int subjectUserId) throws UnauthorizedException
+    {
+	Employee profile = null;
+
+	// Query the database for the profile data of the given employee
+	try
+	{
+	    String query = "SELECT * FROM employee WHERE userid = ?";
+
+	    try
+	    {
+		PreparedStatement answer_statement = WebSession
+			.getConnection(s).prepareStatement(query,
+				ResultSet.TYPE_SCROLL_INSENSITIVE,
+				ResultSet.CONCUR_READ_ONLY);
+		answer_statement.setInt(1, subjectUserId);
+		ResultSet answer_results = answer_statement.executeQuery();
+		if (answer_results.next())
+		{
+		    // Note: Do NOT get the password field.
+		    profile = new Employee(answer_results.getInt("userid"),
+			    answer_results.getString("first_name"),
+			    answer_results.getString("last_name"),
+			    answer_results.getString("ssn"), answer_results
+				    .getString("title"), answer_results
+				    .getString("phone"), answer_results
+				    .getString("address1"), answer_results
+				    .getString("address2"), answer_results
+				    .getInt("manager"), answer_results
+				    .getString("start_date"), answer_results
+				    .getInt("salary"), answer_results
+				    .getString("ccn"), answer_results
+				    .getInt("ccn_limit"), answer_results
+				    .getString("disciplined_date"),
+			    answer_results.getString("disciplined_notes"),
+			    answer_results.getString("personal_description"));
+		    /*					System.out.println("Retrieved employee from db: " + 
+		     profile.getFirstName() + " " + profile.getLastName() + 
+		     " (" + profile.getId() + ")");
+		     */}
+	    }
+	    catch (SQLException sqle)
+	    {
+		s.setMessage("Error getting employee profile");
+		sqle.printStackTrace();
+	    }
+	}
+	catch (Exception e)
+	{
+	    s.setMessage("Error getting employee profile");
+	    e.printStackTrace();
+	}
+
+	return profile;
+    }
+
+}

main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/FindProfile.java

@@ -0,0 +1,256 @@
+package org.owasp.webgoat.lessons.CrossSiteScripting;
+
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import org.owasp.webgoat.lessons.GoatHillsFinancial.DefaultLessonAction;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.GoatHillsFinancial;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.LessonAction;
+import org.owasp.webgoat.session.Employee;
+import org.owasp.webgoat.session.ParameterNotFoundException;
+import org.owasp.webgoat.session.UnauthenticatedException;
+import org.owasp.webgoat.session.UnauthorizedException;
+import org.owasp.webgoat.session.ValidationException;
+import org.owasp.webgoat.session.WebSession;
+
+/*******************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ * 
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at code.google.com, a repository
+ * for free software projects.
+ * 
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+public class FindProfile extends DefaultLessonAction
+{
+
+    private LessonAction chainedAction;
+
+
+    public FindProfile(GoatHillsFinancial lesson, String lessonName,
+	    String actionName, LessonAction chainedAction)
+    {
+	super(lesson, lessonName, actionName);
+	this.chainedAction = chainedAction;
+    }
+
+
+    public void handleRequest(WebSession s) throws ParameterNotFoundException,
+	    UnauthenticatedException, UnauthorizedException,
+	    ValidationException
+    {
+	if (isAuthenticated(s))
+	{
+	    int userId = getIntSessionAttribute(s, getLessonName() + "."
+		    + CrossSiteScripting.USER_ID);
+
+	    String searchName = null;
+	    try
+	    {
+		searchName = getRequestParameter(s,
+			CrossSiteScripting.SEARCHNAME);
+
+		Employee employee = null;
+
+		employee = findEmployeeProfile(s, userId, searchName);
+		if (employee == null)
+		{
+		    setSessionAttribute(s, getLessonName() + "."
+			    + CrossSiteScripting.SEARCHRESULT_ATTRIBUTE_KEY,
+			    "Employee " + searchName + " not found.");
+		}
+	    }
+	    catch (ValidationException e)
+	    {
+		if (CrossSiteScripting.STAGE6.equals(getStage(s)))
+		{
+		    setStageComplete(s, CrossSiteScripting.STAGE6);
+		}
+		throw e;
+	    }
+
+	    if (CrossSiteScripting.STAGE5.equals(getStage(s)))
+	    {
+		if (searchName.indexOf("<script>") > -1
+			&& searchName.indexOf("alert") > -1
+			&& searchName.indexOf("</script>") > -1)
+		{
+		    setStageComplete(s, CrossSiteScripting.STAGE5);
+		}
+	    }
+
+	    // Execute the chained Action if the employee was found.
+	    if (foundEmployee(s))
+	    {
+		try
+		{
+		    chainedAction.handleRequest(s);
+		}
+		catch (UnauthenticatedException ue1)
+		{
+		    System.out.println("Internal server error");
+		    ue1.printStackTrace();
+		}
+		catch (UnauthorizedException ue2)
+		{
+		    System.out.println("Internal server error");
+		    ue2.printStackTrace();
+		}
+	    }
+	}
+	else
+	    throw new UnauthenticatedException();
+    }
+
+
+    public String getNextPage(WebSession s)
+    {
+	String page = CrossSiteScripting.SEARCHSTAFF_ACTION;
+
+	if (foundEmployee(s))
+	    page = CrossSiteScripting.VIEWPROFILE_ACTION;
+
+	return page;
+    }
+
+
+    protected String getRequestParameter(WebSession s, String name)
+	    throws ParameterNotFoundException, ValidationException
+    {
+	return s.getParser().getRawParameter(name);
+    }
+
+
+    protected String getRequestParameter_BACKUP(WebSession s, String name)
+	    throws ParameterNotFoundException, ValidationException
+    {
+	return s.getParser().getRawParameter(name);
+    }
+
+
+    public Employee findEmployeeProfile(WebSession s, int userId, String pattern)
+	    throws UnauthorizedException
+    {
+	Employee profile = null;
+
+	// Query the database for the profile data of the given employee
+	try
+	{
+	    String query = "SELECT * FROM employee WHERE first_name like ? OR last_name like ?";
+
+	    try
+	    {
+		PreparedStatement answer_statement = WebSession
+			.getConnection(s).prepareStatement(query,
+				ResultSet.TYPE_SCROLL_INSENSITIVE,
+				ResultSet.CONCUR_READ_ONLY);
+		answer_statement.setString(1, "%" + pattern + "%");
+		answer_statement.setString(2, "%" + pattern + "%");
+		ResultSet answer_results = answer_statement.executeQuery();
+
+		// Just use the first hit.
+		if (answer_results.next())
+		{
+		    int id = answer_results.getInt("userid");
+		    // Note: Do NOT get the password field.
+		    profile = new Employee(id, answer_results
+			    .getString("first_name"), answer_results
+			    .getString("last_name"), answer_results
+			    .getString("ssn"), answer_results
+			    .getString("title"), answer_results
+			    .getString("phone"), answer_results
+			    .getString("address1"), answer_results
+			    .getString("address2"), answer_results
+			    .getInt("manager"), answer_results
+			    .getString("start_date"), answer_results
+			    .getInt("salary"), answer_results.getString("ccn"),
+			    answer_results.getInt("ccn_limit"), answer_results
+				    .getString("disciplined_date"),
+			    answer_results.getString("disciplined_notes"),
+			    answer_results.getString("personal_description"));
+
+		    /*					System.out.println("Retrieved employee from db: " + 
+		     profile.getFirstName() + " " + profile.getLastName() + 
+		     " (" + profile.getId() + ")");
+		     */
+		    setRequestAttribute(s, getLessonName() + "."
+			    + CrossSiteScripting.EMPLOYEE_ID, Integer
+			    .toString(id));
+		}
+	    }
+	    catch (SQLException sqle)
+	    {
+		s.setMessage("Error finding employee profile");
+		sqle.printStackTrace();
+	    }
+	}
+	catch (Exception e)
+	{
+	    s.setMessage("Error finding employee profile");
+	    e.printStackTrace();
+	}
+
+	return profile;
+    }
+
+
+    private boolean foundEmployee(WebSession s)
+    {
+	boolean found = false;
+	try
+	{
+	    getIntRequestAttribute(s, getLessonName() + "."
+		    + CrossSiteScripting.EMPLOYEE_ID);
+	    found = true;
+	}
+	catch (ParameterNotFoundException e)
+	{}
+
+	return found;
+    }
+
+
+    protected String validate(final String parameter, final Pattern pattern)
+	    throws ValidationException
+    {
+	Matcher matcher = pattern.matcher(parameter);
+	if (!matcher.matches())
+	    throw new ValidationException();
+
+	return parameter;
+    }
+
+    protected static Map<String, Pattern> patterns = new HashMap<String, Pattern>();
+    static
+    {
+	patterns.put(CrossSiteScripting.SEARCHNAME, Pattern
+		.compile("[a-zA-Z ]{0,20}"));
+    }
+
+}

main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/UpdateProfile.java

@@ -0,0 +1,436 @@
+package org.owasp.webgoat.lessons.CrossSiteScripting;
+
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.PreparedStatement;
+import java.sql.Statement;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.owasp.webgoat.lessons.GoatHillsFinancial.DefaultLessonAction;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.GoatHillsFinancial;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.LessonAction;
+import org.owasp.webgoat.session.Employee;
+import org.owasp.webgoat.session.ParameterNotFoundException;
+import org.owasp.webgoat.session.ParameterParser;
+import org.owasp.webgoat.session.UnauthenticatedException;
+import org.owasp.webgoat.session.UnauthorizedException;
+import org.owasp.webgoat.session.ValidationException;
+import org.owasp.webgoat.session.WebSession;
+
+/*******************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ * 
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at code.google.com, a repository
+ * for free software projects.
+ * 
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+public class UpdateProfile extends DefaultLessonAction
+{
+
+    private LessonAction chainedAction;
+
+
+    public UpdateProfile(GoatHillsFinancial lesson, String lessonName,
+	    String actionName, LessonAction chainedAction)
+    {
+	super(lesson, lessonName, actionName);
+	this.chainedAction = chainedAction;
+    }
+
+
+    public void handleRequest(WebSession s) throws ParameterNotFoundException,
+	    UnauthenticatedException, UnauthorizedException,
+	    ValidationException
+    {
+	if (isAuthenticated(s))
+	{
+	    int userId = getIntSessionAttribute(s, getLessonName() + "."
+		    + CrossSiteScripting.USER_ID);
+
+	    int subjectId = s.getParser().getIntParameter(
+		    CrossSiteScripting.EMPLOYEE_ID, 0);
+
+	    Employee employee = null;
+	    try
+	    {
+		employee = parseEmployeeProfile(subjectId, s);
+	    }
+	    catch (ValidationException e)
+	    {
+		if (CrossSiteScripting.STAGE2.equals(getStage(s)))
+		{
+		    setStageComplete(s, CrossSiteScripting.STAGE2);
+		}
+		throw e;
+	    }
+
+	    if (subjectId > 0)
+	    {
+		this.changeEmployeeProfile(s, userId, subjectId, employee);
+		setRequestAttribute(s, getLessonName() + "."
+			+ CrossSiteScripting.EMPLOYEE_ID, Integer
+			.toString(subjectId));
+	    }
+	    else
+		this.createEmployeeProfile(s, userId, employee);
+
+	    try
+	    {
+		chainedAction.handleRequest(s);
+	    }
+	    catch (UnauthenticatedException ue1)
+	    {
+		System.out.println("Internal server error");
+		ue1.printStackTrace();
+	    }
+	    catch (UnauthorizedException ue2)
+	    {
+		System.out.println("Internal server error");
+		ue2.printStackTrace();
+	    }
+	}
+	else
+	    throw new UnauthenticatedException();
+    }
+
+
+    protected Employee parseEmployeeProfile(int subjectId, WebSession s)
+	    throws ParameterNotFoundException, ValidationException
+    {
+	// The input validation can be added using a parsing component 
+	// or by using an inline regular expression. The parsing component 
+	// is the better solution.
+
+	HttpServletRequest request = s.getRequest();
+	String firstName = request.getParameter(CrossSiteScripting.FIRST_NAME);
+	String lastName = request.getParameter(CrossSiteScripting.LAST_NAME);
+	String ssn = request.getParameter(CrossSiteScripting.SSN);
+	String title = request.getParameter(CrossSiteScripting.TITLE);
+	String phone = request.getParameter(CrossSiteScripting.PHONE_NUMBER);
+	String address1 = request.getParameter(CrossSiteScripting.ADDRESS1);
+	String address2 = request.getParameter(CrossSiteScripting.ADDRESS2);
+	int manager = Integer.parseInt(request
+		.getParameter(CrossSiteScripting.MANAGER));
+	String startDate = request.getParameter(CrossSiteScripting.START_DATE);
+	int salary = Integer.parseInt(request
+		.getParameter(CrossSiteScripting.SALARY));
+	String ccn = request.getParameter(CrossSiteScripting.CCN);
+	int ccnLimit = Integer.parseInt(request
+		.getParameter(CrossSiteScripting.CCN_LIMIT));
+	String disciplinaryActionDate = request
+		.getParameter(CrossSiteScripting.DISCIPLINARY_DATE);
+	String disciplinaryActionNotes = request
+		.getParameter(CrossSiteScripting.DISCIPLINARY_NOTES);
+	String personalDescription = request
+		.getParameter(CrossSiteScripting.DESCRIPTION);
+
+	Employee employee = new Employee(subjectId, firstName, lastName, ssn,
+		title, phone, address1, address2, manager, startDate, salary,
+		ccn, ccnLimit, disciplinaryActionDate, disciplinaryActionNotes,
+		personalDescription);
+
+	return employee;
+    }
+
+
+    protected Employee parseEmployeeProfile_BACKUP(int subjectId, WebSession s)
+	    throws ParameterNotFoundException, ValidationException
+    {
+	// The input validation can be added using a parsing component 
+	// or by using an inline regular expression. The parsing component 
+	// is the better solution.
+
+	HttpServletRequest request = s.getRequest();
+	String firstName = request.getParameter(CrossSiteScripting.FIRST_NAME);
+	String lastName = request.getParameter(CrossSiteScripting.LAST_NAME);
+	String ssn = request.getParameter(CrossSiteScripting.SSN);
+	String title = request.getParameter(CrossSiteScripting.TITLE);
+	String phone = request.getParameter(CrossSiteScripting.PHONE_NUMBER);
+	String address1 = request.getParameter(CrossSiteScripting.ADDRESS1);
+	String address2 = request.getParameter(CrossSiteScripting.ADDRESS2);
+	int manager = Integer.parseInt(request
+		.getParameter(CrossSiteScripting.MANAGER));
+	String startDate = request.getParameter(CrossSiteScripting.START_DATE);
+	int salary = Integer.parseInt(request
+		.getParameter(CrossSiteScripting.SALARY));
+	String ccn = request.getParameter(CrossSiteScripting.CCN);
+	int ccnLimit = Integer.parseInt(request
+		.getParameter(CrossSiteScripting.CCN_LIMIT));
+	String disciplinaryActionDate = request
+		.getParameter(CrossSiteScripting.DISCIPLINARY_DATE);
+	String disciplinaryActionNotes = request
+		.getParameter(CrossSiteScripting.DISCIPLINARY_NOTES);
+	String personalDescription = request
+		.getParameter(CrossSiteScripting.DESCRIPTION);
+
+	Employee employee = new Employee(subjectId, firstName, lastName, ssn,
+		title, phone, address1, address2, manager, startDate, salary,
+		ccn, ccnLimit, disciplinaryActionDate, disciplinaryActionNotes,
+		personalDescription);
+
+	return employee;
+    }
+
+
+    protected Employee doParseEmployeeProfile(int subjectId,
+	    ParameterParser parser) throws ParameterNotFoundException,
+	    ValidationException
+    {
+	// Fix this method using the org.owasp.webgoat.session.ParameterParser class 
+	return null;
+    }
+
+
+    public String getNextPage(WebSession s)
+    {
+	return CrossSiteScripting.VIEWPROFILE_ACTION;
+    }
+
+
+    public void changeEmployeeProfile(WebSession s, int userId, int subjectId,
+	    Employee employee) throws UnauthorizedException
+    {
+	try
+	{
+	    // Note: The password field is ONLY set by ChangePassword
+			String query = "UPDATE employee SET first_name = ?, last_name = ?, ssn = ?, title = ?, phone = ?, address1 = ?, address2 = ?,"
+				+ " manager = ?, start_date = ?, ccn = ?, ccn_limit = ?,"
+				+ " personal_description = ? WHERE userid = ?;";
+	    try
+	    {
+			PreparedStatement ps = WebSession.getConnection(s).prepareStatement(query, ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
+
+			ps.setString(1, employee.getFirstName());
+			ps.setString(2, employee.getLastName());
+			ps.setString(3, employee.getSsn());
+			ps.setString(4, employee.getTitle());
+			ps.setString(5, employee.getPhoneNumber());
+			ps.setString(6, employee.getAddress1());
+			ps.setString(7, employee.getAddress2());
+			ps.setInt(8, employee.getManager());
+			ps.setString(9, employee.getStartDate());
+			ps.setString(10, employee.getCcn());
+			ps.setInt(11, employee.getCcnLimit());
+			ps.setString(12, employee.getPersonalDescription());
+			ps.setInt(13, subjectId);
+			ps.execute();
+	    }
+	    catch (SQLException sqle)
+	    {
+		s.setMessage("Error updating employee profile");
+		sqle.printStackTrace();
+	    }
+
+	}
+	catch (Exception e)
+	{
+	    s.setMessage("Error updating employee profile");
+	    e.printStackTrace();
+	}
+    }
+
+
+    public void doChangeEmployeeProfile_BACKUP(WebSession s, int userId,
+	    int subjectId, Employee employee) throws UnauthorizedException
+    {
+	try
+	{
+	    // Note: The password field is ONLY set by ChangePassword
+			String query = "UPDATE employee SET first_name = ?, last_name = ?, ssn = ?, title = ?, phone = ?, address1 = ?, address2 = ?,"
+				+ " manager = ?, start_date = ?, ccn = ?, ccn_limit = ?,"
+				+ " personal_description = ? WHERE userid = ?;";
+	    try
+	    {
+			PreparedStatement ps = WebSession.getConnection(s).prepareStatement(query, ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
+
+			ps.setString(1, employee.getFirstName());
+			ps.setString(2, employee.getLastName());
+			ps.setString(3, employee.getSsn());
+			ps.setString(4, employee.getTitle());
+			ps.setString(5, employee.getPhoneNumber());
+			ps.setString(6, employee.getAddress1());
+			ps.setString(7, employee.getAddress2());
+			ps.setInt(8, employee.getManager());
+			ps.setString(9, employee.getStartDate());
+			ps.setString(10, employee.getCcn());
+			ps.setInt(11, employee.getCcnLimit());
+			ps.setString(12, employee.getPersonalDescription());
+			ps.setInt(13, subjectId);
+			ps.executeUpdate(query);
+	    }
+	    catch (SQLException sqle)
+	    {
+		s.setMessage("Error updating employee profile");
+		sqle.printStackTrace();
+	    }
+
+	}
+	catch (Exception e)
+	{
+	    s.setMessage("Error updating employee profile");
+	    e.printStackTrace();
+	}
+    }
+
+
+    public void createEmployeeProfile(WebSession s, int userId,
+	    Employee employee) throws UnauthorizedException
+    {
+	try
+	{
+	    // FIXME: Cannot choose the id because we cannot guarantee uniqueness
+		int nextId = getNextUID(s);
+	    String query = "INSERT INTO employee VALUES ( " + nextId + ", ?,?,?,?,?,?,?,?,?,?,?,?,?,?)";
+
+	    //System.out.println("Query:  " + query);
+
+	    try
+	    {
+			PreparedStatement ps = WebSession.getConnection(s).prepareStatement(query);
+
+			ps.setString(1, employee.getFirstName().toLowerCase());
+			ps.setString(2, employee.getLastName());
+			ps.setString(3, employee.getSsn());
+			ps.setString(4, employee.getTitle());
+			ps.setString(5, employee.getPhoneNumber());
+			ps.setString(6, employee.getAddress1());
+			ps.setString(7, employee.getAddress2());
+			ps.setInt(8, employee.getManager());
+			ps.setString(9, employee.getStartDate());
+			ps.setString(10, employee.getCcn());
+			ps.setInt(11, employee.getCcnLimit());
+			ps.setString(12, employee.getDisciplinaryActionDate());
+			ps.setString(13, employee.getDisciplinaryActionNotes());
+			ps.setString(14, employee.getPersonalDescription());
+
+			ps.execute();
+	    }
+	    catch (SQLException sqle)
+	    {
+		s.setMessage("Error updating employee profile");
+		sqle.printStackTrace();
+	    }
+	}
+	catch (Exception e)
+	{
+	    s.setMessage("Error updating employee profile");
+	    e.printStackTrace();
+	}
+    }
+
+
+    public void createEmployeeProfile_BACKUP(WebSession s, int userId,
+	    Employee employee) throws UnauthorizedException
+    {
+	try
+	{
+	    // FIXME: Cannot choose the id because we cannot guarantee uniqueness
+			int nextId = getNextUID(s);
+		    String query = "INSERT INTO employee VALUES ( " + nextId + ", ?,?,?,?,?,?,?,?,?,?,?,?,?,?)";
+
+	    //System.out.println("Query:  " + query);
+
+	    try
+	    {
+			PreparedStatement ps = WebSession.getConnection(s).prepareStatement(query);
+
+			ps.setString(1, employee.getFirstName().toLowerCase());
+			ps.setString(2, employee.getLastName());
+			ps.setString(3, employee.getSsn());
+			ps.setString(4, employee.getTitle());
+			ps.setString(5, employee.getPhoneNumber());
+			ps.setString(6, employee.getAddress1());
+			ps.setString(7, employee.getAddress2());
+			ps.setInt(8, employee.getManager());
+			ps.setString(9, employee.getStartDate());
+			ps.setString(10, employee.getCcn());
+			ps.setInt(11, employee.getCcnLimit());
+			ps.setString(12, employee.getDisciplinaryActionDate());
+			ps.setString(13, employee.getDisciplinaryActionNotes());
+			ps.setString(14, employee.getPersonalDescription());
+
+			ps.execute();
+	    }
+	    catch (SQLException sqle)
+	    {
+		s.setMessage("Error updating employee profile");
+		sqle.printStackTrace();
+	    }
+	}
+	catch (Exception e)
+	{
+	    s.setMessage("Error updating employee profile");
+	    e.printStackTrace();
+	}
+    }
+
+
+    /**
+     * Validates that the given parameter value matches the given regular expression pattern.
+     * 
+     * @param parameter
+     * @param pattern
+     * @return
+     * @throws ValidationException
+     */
+    protected String validate(final String parameter, final Pattern pattern)
+	    throws ValidationException
+    {
+	Matcher matcher = pattern.matcher(parameter);
+	if (!matcher.matches())
+	    throw new ValidationException();
+
+	return parameter;
+    }
+
+    private int getNextUID(WebSession s)
+    {
+	int uid = -1;
+	try
+	{
+	    Statement statement = WebSession.getConnection(s).createStatement(
+		    ResultSet.TYPE_SCROLL_INSENSITIVE,
+		    ResultSet.CONCUR_READ_ONLY);
+	    ResultSet results = statement
+		    .executeQuery("select max(userid) as uid from employee");
+	    results.first();
+	    uid = results.getInt("uid");
+	}
+	catch (SQLException sqle)
+	{
+	    sqle.printStackTrace();
+	    s.setMessage("Error updating employee profile");
+	}
+	catch (ClassNotFoundException e)
+	{
+	    // TODO Auto-generated catch block
+	    e.printStackTrace();
+	}
+	return uid + 1;
+    }
+}

main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/ViewProfile.java

@@ -0,0 +1,252 @@
+package org.owasp.webgoat.lessons.CrossSiteScripting;
+
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+
+import org.owasp.webgoat.lessons.GoatHillsFinancial.DefaultLessonAction;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.GoatHillsFinancial;
+import org.owasp.webgoat.session.Employee;
+import org.owasp.webgoat.session.ParameterNotFoundException;
+import org.owasp.webgoat.session.UnauthenticatedException;
+import org.owasp.webgoat.session.UnauthorizedException;
+import org.owasp.webgoat.session.ValidationException;
+import org.owasp.webgoat.session.WebSession;
+
+/*******************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ * 
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at code.google.com, a repository
+ * for free software projects.
+ * 
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+public class ViewProfile extends DefaultLessonAction
+{
+
+    public ViewProfile(GoatHillsFinancial lesson, String lessonName,
+	    String actionName)
+    {
+	super(lesson, lessonName, actionName);
+    }
+
+
+    public void handleRequest(WebSession s) throws ParameterNotFoundException,
+	    UnauthenticatedException, UnauthorizedException,
+	    ValidationException
+    {
+	getLesson().setCurrentAction(s, getActionName());
+
+	if (isAuthenticated(s))
+	{
+	    int userId = getIntSessionAttribute(s, getLessonName() + "."
+		    + CrossSiteScripting.USER_ID);
+	    int employeeId = -1;
+	    try
+	    {
+		// User selected employee
+		employeeId = s.getParser().getIntParameter(
+			CrossSiteScripting.EMPLOYEE_ID);
+	    }
+	    catch (ParameterNotFoundException e)
+	    {
+		// May be an internally selected employee
+		employeeId = getIntRequestAttribute(s, getLessonName() + "."
+			+ CrossSiteScripting.EMPLOYEE_ID);
+	    }
+
+	    Employee employee = getEmployeeProfile(s, userId, employeeId);
+	    setSessionAttribute(s, getLessonName() + "."
+		    + CrossSiteScripting.EMPLOYEE_ATTRIBUTE_KEY, employee);
+
+	    updateLessonStatus(s, employee);
+	}
+	else
+	    throw new UnauthenticatedException();
+    }
+
+
+    public String getNextPage(WebSession s)
+    {
+	return CrossSiteScripting.VIEWPROFILE_ACTION;
+    }
+
+
+    public Employee getEmployeeProfile(WebSession s, int userId,
+	    int subjectUserId) throws UnauthorizedException
+    {
+	Employee profile = null;
+
+	// Query the database for the profile data of the given employee
+	try
+	{
+	    String query = "SELECT * FROM employee WHERE userid = "
+		    + subjectUserId;
+
+	    try
+	    {
+		Statement answer_statement = WebSession.getConnection(s)
+			.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
+				ResultSet.CONCUR_READ_ONLY);
+		ResultSet answer_results = answer_statement.executeQuery(query);
+		if (answer_results.next())
+		{
+		    // Note: Do NOT get the password field.
+		    profile = new Employee(answer_results.getInt("userid"),
+			    answer_results.getString("first_name"),
+			    answer_results.getString("last_name"),
+			    answer_results.getString("ssn"), answer_results
+				    .getString("title"), answer_results
+				    .getString("phone"), answer_results
+				    .getString("address1"), answer_results
+				    .getString("address2"), answer_results
+				    .getInt("manager"), answer_results
+				    .getString("start_date"), answer_results
+				    .getInt("salary"), answer_results
+				    .getString("ccn"), answer_results
+				    .getInt("ccn_limit"), answer_results
+				    .getString("disciplined_date"),
+			    answer_results.getString("disciplined_notes"),
+			    answer_results.getString("personal_description"));
+		    /*					System.out.println("Retrieved employee from db: " + 
+		     profile.getFirstName() + " " + profile.getLastName() + 
+		     " (" + profile.getId() + ")");
+		     */}
+	    }
+	    catch (SQLException sqle)
+	    {
+		s.setMessage("Error getting employee profile");
+		sqle.printStackTrace();
+	    }
+	}
+	catch (Exception e)
+	{
+	    s.setMessage("Error getting employee profile");
+	    e.printStackTrace();
+	}
+
+	return profile;
+    }
+
+
+    public Employee getEmployeeProfile_BACKUP(WebSession s, int userId,
+	    int subjectUserId) throws UnauthorizedException
+    {
+	// Query the database to determine if this employee has access to this function
+	// Query the database for the profile data of the given employee if "owned" by the given user
+
+	Employee profile = null;
+
+	// Query the database for the profile data of the given employee
+	try
+	{
+	    String query = "SELECT * FROM employee WHERE userid = "
+		    + subjectUserId;
+
+	    try
+	    {
+		Statement answer_statement = WebSession.getConnection(s)
+			.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
+				ResultSet.CONCUR_READ_ONLY);
+		ResultSet answer_results = answer_statement.executeQuery(query);
+		if (answer_results.next())
+		{
+		    // Note: Do NOT get the password field.
+		    profile = new Employee(answer_results.getInt("userid"),
+			    answer_results.getString("first_name"),
+			    answer_results.getString("last_name"),
+			    answer_results.getString("ssn"), answer_results
+				    .getString("title"), answer_results
+				    .getString("phone"), answer_results
+				    .getString("address1"), answer_results
+				    .getString("address2"), answer_results
+				    .getInt("manager"), answer_results
+				    .getString("start_date"), answer_results
+				    .getInt("salary"), answer_results
+				    .getString("ccn"), answer_results
+				    .getInt("ccn_limit"), answer_results
+				    .getString("disciplined_date"),
+			    answer_results.getString("disciplined_notes"),
+			    answer_results.getString("personal_description"));
+		    /*					System.out.println("Retrieved employee from db: " + 
+		     profile.getFirstName() + " " + profile.getLastName() + 
+		     " (" + profile.getId() + ")");
+		     */}
+	    }
+	    catch (SQLException sqle)
+	    {
+		s.setMessage("Error getting employee profile");
+		sqle.printStackTrace();
+	    }
+	}
+	catch (Exception e)
+	{
+	    s.setMessage("Error getting employee profile");
+	    e.printStackTrace();
+	}
+
+	return profile;
+    }
+
+
+    private void updateLessonStatus(WebSession s, Employee employee)
+    {
+	String stage = getStage(s);
+	int userId = -1;
+	try {
+		userId = getIntSessionAttribute(s, getLessonName() + "."
+		    + CrossSiteScripting.USER_ID);
+	} catch (ParameterNotFoundException pnfe) {
+	}
+	if (CrossSiteScripting.STAGE1.equals(stage))
+	{
+		String address1 = employee.getAddress1().toLowerCase();
+		if (userId != employee.getId()
+			&& address1.indexOf("<script>") > -1
+			&& address1.indexOf("alert") > -1
+			&& address1.indexOf("</script>") > -1)
+		{
+		    setStageComplete(s, CrossSiteScripting.STAGE1);
+		}
+	}
+	else if (CrossSiteScripting.STAGE3.equals(stage))
+	{
+		String address2 = employee.getAddress1().toLowerCase();
+		if (address2.indexOf("<script>") > -1
+			&& address2.indexOf("alert") > -1
+			&& address2.indexOf("</script>") > -1)
+		{
+		    setStageComplete(s, CrossSiteScripting.STAGE3);
+		}
+	}
+	else if (CrossSiteScripting.STAGE4.equals(stage))
+	{
+		if (employee.getAddress1().toLowerCase().indexOf("&lt;") > -1)
+		{
+		    setStageComplete(s, CrossSiteScripting.STAGE4);
+		}
+	}
+    }
+
+}