dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Challenge 3: displaying comments

Browse Source
This commit is contained in:
Nanne Baars 2017-04-09 01:40:04 +02:00
parent 508f128744
commit c0b46221b7
3 changed files with 38 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge3/Challenge3.java
View File

@ -50,8 +50,8 @@ public class Challenge3 extends AssignmentEndpoint {
@RequestMapping(method = POST, consumes = ALL_VALUE, produces = APPLICATION_JSON_VALUE)
@ResponseBody
public AttackResult createNewUser(@RequestBody String commentStr, @RequestHeader("Content-Type") String contentType) throws Exception {
Comment comment = new Comment();
public AttackResult createNewComment(@RequestBody String commentStr, @RequestHeader("Content-Type") String contentType) throws Exception {
Comment comment = null;
AttackResult attackResult = failed().build();
if (APPLICATION_JSON_VALUE.equals(contentType)) {
comment = parseJson(commentStr);
@ -63,10 +63,13 @@ public class Challenge3 extends AssignmentEndpoint {
comment.setDateTime(DateTime.now().toString());
comment.setUser(webSession.getUserName());
}
if (checkSolution(comment)) {
attackResult = success().feedback("challenge.solved").feedbackArgs(Flag.FLAGS.get(2)).build();
if (comment != null) {
comments.add(comment);
if (checkSolution(comment)) {
attackResult = success().feedback("challenge.solved").feedbackArgs(Flag.FLAGS.get(2)).build();
}
}
return attackResult;
}

43
webgoat-lessons/challenge/src/main/resources/html/Challenge.html
View File

@ -195,49 +195,6 @@
</div>
<ul class="comments-list">
<div id="list">
<li class="comment">
<div class="pull-left">
<img class="avatar"
src="http://bootdey.com/img/Content/avatar/avatar1.png"
alt="avatar"/>
</div>
<div class="comment-body">
<div class="comment-heading">
<h4 class="user">John dOE</h4>
<h5 class="time">7 minutes ago</h5>
</div>
<p>I really love this picture. I really wish i could have been
there.</p>
</div>
</li>
<li class="comment">
<div class="pull-left" href="javascript:void(0);">
<img class="avatar"
src="http://bootdey.com/img/Content/avatar/avatar2.png"
alt="avatar"/>
</div>
<div class="comment-body">
<div class="comment-heading">
<h4 class="user">John Doe</h4>
<h5 class="time">3 minutes ago</h5>
</div>
<p>I think I might you this for one of my projects.</p>
</div>
</li>
<li class="comment">
<div class="pull-left" href="javascript:void(0);">
<img class="avatar"
src="http://bootdey.com/img/Content/avatar/avatar4.png"
alt="avatar"/>
</div>
<div class="comment-body">
<div class="comment-heading">
<h4 class="user">John Doe</h4>
<h5 class="time">10 seconds ago</h5>
</div>
<p>Wow! This is gorgeous.</p>
</div>
</li>
</div>
</ul>
</div>

40
webgoat-lessons/challenge/src/main/resources/js/challenge3.js
View File

@ -1,15 +1,35 @@
$(document).ready(function () {
$("#postComment").on("blur", function () {
var comment = $("#commentInput").val();
$.post("challenge3", function (result, status) {
var json;
json = '{' +
' "comment":' + '"' + comment + '"'
'}';
})
$("#postComment").on("click", function () {
var commentInput = $("#commentInput").val();
$.ajax({
type: 'POST',
url: 'challenge/3',
data: JSON.stringify ({comment: commentInput}),
contentType: "application/json",
dataType: 'json'
});
})
var html = '<li class="comment">' +
'<div class="pull-left">' +
'<img class="avatar" src="http://bootdey.com/img/Content/avatar/avatar1.png" alt="avatar"/>' +
'</div>' +
'<div class="comment-body">' +
'<div class="comment-heading">' +
'<h4 class="user">USER</h4>' +
'<h5 class="time">DATETIME</h5>' +
'</div>' +
'<p>COMMENT</p>' +
'</div>' +
'</li>';
$.get("challenge/3", function (result, status) {
alert("Hello");
})
for (var i = 0; i < result.length; i++) {
var comment = html.replace('USER', result[i].user);
comment = comment.replace('DATETIME', result[i].dateTime);
comment = comment.replace('COMMENT', result[i].comment);
$("#list").append(comment);
}
});
})