diff --git a/webgoat-container/pom.xml b/webgoat-container/pom.xml index 9774eff3f..cb744d3a0 100644 --- a/webgoat-container/pom.xml +++ b/webgoat-container/pom.xml @@ -166,6 +166,18 @@ + + org.apache.maven.plugins + maven-jar-plugin + 3.0.2 + + + + test-jar + + + + diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/i18n/Messages.java b/webgoat-container/src/main/java/org/owasp/webgoat/i18n/Messages.java index e0e61583c..d44fbedd8 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/i18n/Messages.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/i18n/Messages.java @@ -60,7 +60,7 @@ public class Messages extends ReloadableResourceBundleMessageSource { return super.getMessage(code, args, defaultValue, resolveLocale()); } - private Locale resolveLocale() { + protected Locale resolveLocale() { return localeResolver.resolveLocale(((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes()).getRequest()); } diff --git a/webgoat-container/src/test/java/org/owasp/webgoat/assignments/AssignmentEndpointTest.java b/webgoat-container/src/test/java/org/owasp/webgoat/assignments/AssignmentEndpointTest.java new file mode 100644 index 000000000..8c5ae41be --- /dev/null +++ b/webgoat-container/src/test/java/org/owasp/webgoat/assignments/AssignmentEndpointTest.java @@ -0,0 +1,72 @@ +/* + * This file is part of WebGoat, an Open Web Application Security Project utility. For details, + * please see http://www.owasp.org/ + *

+ * Copyright (c) 2002 - 2017 Bruce Mayhew + *

+ * This program is free software; you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + *

+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + *

+ * You should have received a copy of the GNU General Public License along with this program; if + * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA + * 02111-1307, USA. + *

+ * Getting Source ============== + *

+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software + * projects. + *

+ */ + +package org.owasp.webgoat.assignments; + +import org.mockito.Mock; +import org.owasp.webgoat.i18n.Messages; +import org.owasp.webgoat.session.UserSessionData; +import org.owasp.webgoat.session.UserTracker; +import org.owasp.webgoat.session.WebSession; +import org.springframework.test.util.ReflectionTestUtils; +import org.springframework.web.servlet.LocaleResolver; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.util.Locale; + +public class AssignmentEndpointTest { + + @Mock + protected UserTracker userTracker; + @Mock + protected WebSession webSession; + @Mock + protected UserSessionData userSessionData; + protected Messages messages = new Messages(new LocaleResolver() { + @Override + public Locale resolveLocale(HttpServletRequest request) { + return Locale.ENGLISH; + } + + @Override + public void setLocale(HttpServletRequest request, HttpServletResponse response, Locale locale) { + + }}){ + @Override + protected Locale resolveLocale() { + return Locale.ENGLISH; + } + }; + + public void init(AssignmentEndpoint a) { + messages.setBasenames("classpath:/i18n/messages", "classpath:/plugin/i18n/WebGoatLabels"); + ReflectionTestUtils.setField(a, "userTracker", userTracker); + ReflectionTestUtils.setField(a, "userSessionData", userSessionData); + ReflectionTestUtils.setField(a, "webSession", webSession); + ReflectionTestUtils.setField(a, "messages", messages); + } + +} \ No newline at end of file diff --git a/webgoat-lessons/http-proxies/pom.xml b/webgoat-lessons/http-proxies/pom.xml index f11096287..313061c5d 100644 --- a/webgoat-lessons/http-proxies/pom.xml +++ b/webgoat-lessons/http-proxies/pom.xml @@ -9,4 +9,26 @@ 8.0-SNAPSHOT + + + org.springframework.boot + spring-boot-starter-test + test + + + org.springframework.security + spring-security-test + 4.1.3.RELEASE + test + + + junit + junit + ${junit.version} + jar + test + + + + diff --git a/webgoat-lessons/http-proxies/src/test/java/org/owasp/webgoat/plugin/HttpBasicsInterceptRequestTest.java b/webgoat-lessons/http-proxies/src/test/java/org/owasp/webgoat/plugin/HttpBasicsInterceptRequestTest.java new file mode 100644 index 000000000..90686bca7 --- /dev/null +++ b/webgoat-lessons/http-proxies/src/test/java/org/owasp/webgoat/plugin/HttpBasicsInterceptRequestTest.java @@ -0,0 +1,73 @@ +/* + * This file is part of WebGoat, an Open Web Application Security Project utility. For details, + * please see http://www.owasp.org/ + *

+ * Copyright (c) 2002 - 2017 Bruce Mayhew + *

+ * This program is free software; you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + *

+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + *

+ * You should have received a copy of the GNU General Public License along with this program; if + * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA + * 02111-1307, USA. + *

+ * Getting Source ============== + *

+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software + * projects. + *

+ */ + +package org.owasp.webgoat.plugin; + +import org.hamcrest.CoreMatchers; +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.runners.MockitoJUnitRunner; +import org.owasp.webgoat.assignments.AssignmentEndpointTest; +import org.springframework.test.web.servlet.MockMvc; +import org.springframework.test.web.servlet.request.MockMvcRequestBuilders; +import org.springframework.test.web.servlet.result.MockMvcResultHandlers; + +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; +import static org.springframework.test.web.servlet.setup.MockMvcBuilders.standaloneSetup; + +@RunWith(MockitoJUnitRunner.class) +public class HttpBasicsInterceptRequestTest extends AssignmentEndpointTest { + + private MockMvc mockMvc; + + @Before + public void setup() { + HttpBasicsInterceptRequest httpBasicsInterceptRequest = new HttpBasicsInterceptRequest(); + init(httpBasicsInterceptRequest); + this.mockMvc = standaloneSetup(httpBasicsInterceptRequest).build(); + } + + @Test + public void success() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.get("/HttpProxies/intercept-request") + .header("x-request-intercepted", "true") + .param("changeMe", "Requests are tampered easily")) + .andExpect(status().isOk()).andDo(MockMvcResultHandlers.print()) + .andExpect(jsonPath("$.feedback", CoreMatchers.is(messages.getMessage("http-proxies.intercept.success")))) + .andExpect(jsonPath("$.lessonCompleted", CoreMatchers.is(true))); + } + + @Test + public void failure() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.get("/HttpProxies/intercept-request") + .header("x-request-intercepted", "false") + .param("changeMe", "Requests are tampered easily")) + .andExpect(status().isOk()).andDo(MockMvcResultHandlers.print()) + .andExpect(jsonPath("$.feedback", CoreMatchers.is(messages.getMessage("http-proxies.intercept.failure")))) + .andExpect(jsonPath("$.lessonCompleted", CoreMatchers.is(false))); + } +} \ No newline at end of file diff --git a/webgoat-lessons/pom.xml b/webgoat-lessons/pom.xml index 190ae2f84..5cd7d559d 100644 --- a/webgoat-lessons/pom.xml +++ b/webgoat-lessons/pom.xml @@ -36,6 +36,13 @@ commons-exec 1.3 + + org.owasp.webgoat + webgoat-container + ${project.version} + tests + test +