Apply formatting
This will make sure we have a consistent style across our project and the PRs are only concerned with actual changes and no longer about style.
This commit is contained in:
Nanne Baars
GitHub
@ -1,34 +1,34 @@
|
||||
package org.owasp.webgoat.container.lessons;
|
||||
|
||||
import lombok.*;
|
||||
|
||||
import javax.persistence.*;
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import javax.persistence.*;
|
||||
import lombok.*;
|
||||
|
||||
/**
|
||||
* ************************************************************************************************
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
* <p>
|
||||
* Copyright (c) 2002 - 2014 Bruce Mayhew
|
||||
* <p>
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
*
|
||||
* <p>Copyright (c) 2002 - 2014 Bruce Mayhew
|
||||
*
|
||||
* <p>This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
* <p>
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
* <p>
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
*
|
||||
* <p>This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
|
||||
* without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* <p>You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
* <p>
|
||||
* Getting Source ==============
|
||||
* <p>
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* <p>Getting Source ==============
|
||||
*
|
||||
* <p>Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* @author nbaars
|
||||
@ -40,30 +40,33 @@ import java.util.List;
|
||||
@Entity
|
||||
public class Assignment {
|
||||
|
||||
@Id
|
||||
@GeneratedValue(strategy = GenerationType.AUTO)
|
||||
private Long id;
|
||||
private String name;
|
||||
private String path;
|
||||
@Id
|
||||
@GeneratedValue(strategy = GenerationType.AUTO)
|
||||
private Long id;
|
||||
|
||||
@Transient
|
||||
private List<String> hints;
|
||||
private String name;
|
||||
private String path;
|
||||
|
||||
private Assignment() {
|
||||
//Hibernate
|
||||
@Transient private List<String> hints;
|
||||
|
||||
private Assignment() {
|
||||
// Hibernate
|
||||
}
|
||||
|
||||
public Assignment(String name) {
|
||||
this(name, name, new ArrayList<>());
|
||||
}
|
||||
|
||||
public Assignment(String name, String path, List<String> hints) {
|
||||
if (path.equals("") || path.equals("/") || path.equals("/WebGoat/")) {
|
||||
throw new IllegalStateException(
|
||||
"The path of assignment '"
|
||||
+ name
|
||||
+ "' overrides WebGoat endpoints, please choose a path within the scope of the"
|
||||
+ " lesson");
|
||||
}
|
||||
|
||||
public Assignment(String name) {
|
||||
this(name, name, new ArrayList<>());
|
||||
}
|
||||
|
||||
public Assignment(String name, String path, List<String> hints) {
|
||||
if (path.equals("") || path.equals("/") || path.equals("/WebGoat/")) {
|
||||
throw new IllegalStateException("The path of assignment '" + name + "' overrides WebGoat endpoints, please choose a path within the scope of the lesson");
|
||||
}
|
||||
this.name = name;
|
||||
this.path = path;
|
||||
this.hints = hints;
|
||||
}
|
||||
|
||||
this.name = name;
|
||||
this.path = path;
|
||||
this.hints = hints;
|
||||
}
|
||||
}
|
||||
|
||||
@ -4,30 +4,29 @@ import lombok.Getter;
|
||||
|
||||
/**
|
||||
* *************************************************************************************************
|
||||
*
|
||||
* <p>
|
||||
* <p>
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
* <p>
|
||||
* Copyright (c) 2002 - 2014 Bruce Mayhew
|
||||
* <p>
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
* <p>
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
* <p>
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
* <p>
|
||||
* Getting Source ==============
|
||||
* <p>
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
|
||||
*
|
||||
* <p>This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* <p>Copyright (c) 2002 - 2014 Bruce Mayhew
|
||||
*
|
||||
* <p>This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* <p>This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
|
||||
* without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* <p>You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* <p>Getting Source ==============
|
||||
*
|
||||
* <p>Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
@ -35,40 +34,35 @@ import lombok.Getter;
|
||||
* @since October 28, 2003
|
||||
*/
|
||||
public enum Category {
|
||||
INTRODUCTION("Introduction", 5),
|
||||
GENERAL("General", 100),
|
||||
|
||||
INTRODUCTION("Introduction", 5),
|
||||
GENERAL("General", 100),
|
||||
|
||||
A1("(A1) Broken Access Control", 301),
|
||||
A2("(A2) Cryptographic Failures", 302),
|
||||
A3("(A3) Injection", 303),
|
||||
A1("(A1) Broken Access Control", 301),
|
||||
A2("(A2) Cryptographic Failures", 302),
|
||||
A3("(A3) Injection", 303),
|
||||
|
||||
A5("(A5) Security Misconfiguration", 305),
|
||||
A6("(A6) Vuln & Outdated Components", 306),
|
||||
A7("(A7) Identity & Auth Failure", 307),
|
||||
A8("(A8) Software & Data Integrity", 308),
|
||||
A9("(A9) Security Logging Failures", 309),
|
||||
A10("(A10) Server-side Request Forgery", 310),
|
||||
|
||||
CLIENT_SIDE("Client side", 1700),
|
||||
A5("(A5) Security Misconfiguration", 305),
|
||||
A6("(A6) Vuln & Outdated Components", 306),
|
||||
A7("(A7) Identity & Auth Failure", 307),
|
||||
A8("(A8) Software & Data Integrity", 308),
|
||||
A9("(A9) Security Logging Failures", 309),
|
||||
A10("(A10) Server-side Request Forgery", 310),
|
||||
|
||||
CHALLENGE("Challenges", 3000);
|
||||
CLIENT_SIDE("Client side", 1700),
|
||||
|
||||
@Getter
|
||||
private String name;
|
||||
@Getter
|
||||
private Integer ranking;
|
||||
CHALLENGE("Challenges", 3000);
|
||||
|
||||
Category(String name, Integer ranking) {
|
||||
this.name = name;
|
||||
this.ranking = ranking;
|
||||
}
|
||||
@Getter private String name;
|
||||
@Getter private Integer ranking;
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
@Override
|
||||
public String toString() {
|
||||
return getName();
|
||||
}
|
||||
Category(String name, Integer ranking) {
|
||||
this.name = name;
|
||||
this.ranking = ranking;
|
||||
}
|
||||
|
||||
/** {@inheritDoc} */
|
||||
@Override
|
||||
public String toString() {
|
||||
return getName();
|
||||
}
|
||||
}
|
||||
|
||||
@ -22,6 +22,11 @@
|
||||
|
||||
package org.owasp.webgoat.container.lessons;
|
||||
|
||||
import static java.util.stream.Collectors.groupingBy;
|
||||
|
||||
import java.lang.reflect.Method;
|
||||
import java.lang.reflect.ParameterizedType;
|
||||
import java.util.*;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import org.apache.commons.lang3.ArrayUtils;
|
||||
import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
|
||||
@ -36,91 +41,103 @@ import org.springframework.web.bind.annotation.PostMapping;
|
||||
import org.springframework.web.bind.annotation.PutMapping;
|
||||
import org.springframework.web.bind.annotation.RequestMapping;
|
||||
|
||||
import java.lang.reflect.Method;
|
||||
import java.lang.reflect.ParameterizedType;
|
||||
import java.util.*;
|
||||
|
||||
import static java.util.stream.Collectors.groupingBy;
|
||||
import static java.util.stream.Collectors.toList;
|
||||
|
||||
@Slf4j
|
||||
@Configuration
|
||||
public class CourseConfiguration {
|
||||
|
||||
private final List<Lesson> lessons;
|
||||
private final List<AssignmentEndpoint> assignments;
|
||||
private final Map<String, List<AssignmentEndpoint>> assignmentsByPackage;
|
||||
private final List<Lesson> lessons;
|
||||
private final List<AssignmentEndpoint> assignments;
|
||||
private final Map<String, List<AssignmentEndpoint>> assignmentsByPackage;
|
||||
|
||||
public CourseConfiguration(List<Lesson> lessons, List<AssignmentEndpoint> assignments) {
|
||||
this.lessons = lessons;
|
||||
this.assignments = assignments;
|
||||
assignmentsByPackage = this.assignments.stream().collect(groupingBy(a -> a.getClass().getPackageName()));
|
||||
}
|
||||
public CourseConfiguration(List<Lesson> lessons, List<AssignmentEndpoint> assignments) {
|
||||
this.lessons = lessons;
|
||||
this.assignments = assignments;
|
||||
assignmentsByPackage =
|
||||
this.assignments.stream().collect(groupingBy(a -> a.getClass().getPackageName()));
|
||||
}
|
||||
|
||||
@Bean
|
||||
public Course course() {
|
||||
lessons.stream().forEach(l -> l.setAssignments(createAssignment(l)));
|
||||
return new Course(lessons);
|
||||
}
|
||||
@Bean
|
||||
public Course course() {
|
||||
lessons.stream().forEach(l -> l.setAssignments(createAssignment(l)));
|
||||
return new Course(lessons);
|
||||
}
|
||||
|
||||
private List<Assignment> createAssignment(Lesson lesson) {
|
||||
var endpoints = assignmentsByPackage.get(lesson.getClass().getPackageName());
|
||||
if (CollectionUtils.isEmpty(endpoints)) {
|
||||
log.warn("Lesson: {} has no endpoints, is this intentionally?", lesson.getTitle());
|
||||
return new ArrayList<>();
|
||||
}
|
||||
return endpoints.stream()
|
||||
.map(e -> new Assignment(e.getClass().getSimpleName(), getPath(e.getClass()), getHints(e.getClass())))
|
||||
.toList();
|
||||
private List<Assignment> createAssignment(Lesson lesson) {
|
||||
var endpoints = assignmentsByPackage.get(lesson.getClass().getPackageName());
|
||||
if (CollectionUtils.isEmpty(endpoints)) {
|
||||
log.warn("Lesson: {} has no endpoints, is this intentionally?", lesson.getTitle());
|
||||
return new ArrayList<>();
|
||||
}
|
||||
return endpoints.stream()
|
||||
.map(
|
||||
e ->
|
||||
new Assignment(
|
||||
e.getClass().getSimpleName(), getPath(e.getClass()), getHints(e.getClass())))
|
||||
.toList();
|
||||
}
|
||||
|
||||
private String getPath(Class<? extends AssignmentEndpoint> e) {
|
||||
for (Method m : e.getMethods()) {
|
||||
if (methodReturnTypeIsOfTypeAttackResult(m)) {
|
||||
var mapping = getMapping(m);
|
||||
if (mapping != null) {
|
||||
return mapping;
|
||||
}
|
||||
}
|
||||
private String getPath(Class<? extends AssignmentEndpoint> e) {
|
||||
for (Method m : e.getMethods()) {
|
||||
if (methodReturnTypeIsOfTypeAttackResult(m)) {
|
||||
var mapping = getMapping(m);
|
||||
if (mapping != null) {
|
||||
return mapping;
|
||||
}
|
||||
throw new IllegalStateException("Assignment endpoint: " + e + " has no mapping like @GetMapping/@PostMapping etc," +
|
||||
"with return type 'AttackResult' or 'ResponseEntity<AttackResult>' please consider adding one");
|
||||
}
|
||||
}
|
||||
throw new IllegalStateException(
|
||||
"Assignment endpoint: "
|
||||
+ e
|
||||
+ " has no mapping like @GetMapping/@PostMapping etc,with return type 'AttackResult' or"
|
||||
+ " 'ResponseEntity<AttackResult>' please consider adding one");
|
||||
}
|
||||
|
||||
private boolean methodReturnTypeIsOfTypeAttackResult(Method m) {
|
||||
if (m.getReturnType() == AttackResult.class) {
|
||||
return true;
|
||||
}
|
||||
var genericType = m.getGenericReturnType();
|
||||
if (genericType instanceof ParameterizedType) {
|
||||
return ((ParameterizedType) m.getGenericReturnType()).getActualTypeArguments()[0] == AttackResult.class;
|
||||
}
|
||||
return false;
|
||||
private boolean methodReturnTypeIsOfTypeAttackResult(Method m) {
|
||||
if (m.getReturnType() == AttackResult.class) {
|
||||
return true;
|
||||
}
|
||||
var genericType = m.getGenericReturnType();
|
||||
if (genericType instanceof ParameterizedType) {
|
||||
return ((ParameterizedType) m.getGenericReturnType()).getActualTypeArguments()[0]
|
||||
== AttackResult.class;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
private String getMapping(Method m) {
|
||||
String[] paths = null;
|
||||
//Find the path, either it is @GetMapping("/attack") of GetMapping(path = "/attack") both are valid, we need to consider both
|
||||
if (m.getAnnotation(RequestMapping.class) != null) {
|
||||
paths = ArrayUtils.addAll(m.getAnnotation(RequestMapping.class).value(), m.getAnnotation(RequestMapping.class).path());
|
||||
} else if (m.getAnnotation(PostMapping.class) != null) {
|
||||
paths = ArrayUtils.addAll(m.getAnnotation(PostMapping.class).value(), m.getAnnotation(PostMapping.class).path());
|
||||
} else if (m.getAnnotation(GetMapping.class) != null) {
|
||||
paths = ArrayUtils.addAll(m.getAnnotation(GetMapping.class).value(), m.getAnnotation(GetMapping.class).path());
|
||||
} else if (m.getAnnotation(PutMapping.class) != null) {
|
||||
paths = ArrayUtils.addAll(m.getAnnotation(PutMapping.class).value(), m.getAnnotation(PutMapping.class).path());
|
||||
}
|
||||
if (paths == null) {
|
||||
return null;
|
||||
} else {
|
||||
return Arrays.stream(paths).filter(path -> !"".equals(path)).findFirst().orElse("");
|
||||
}
|
||||
private String getMapping(Method m) {
|
||||
String[] paths = null;
|
||||
// Find the path, either it is @GetMapping("/attack") of GetMapping(path = "/attack") both are
|
||||
// valid, we need to consider both
|
||||
if (m.getAnnotation(RequestMapping.class) != null) {
|
||||
paths =
|
||||
ArrayUtils.addAll(
|
||||
m.getAnnotation(RequestMapping.class).value(),
|
||||
m.getAnnotation(RequestMapping.class).path());
|
||||
} else if (m.getAnnotation(PostMapping.class) != null) {
|
||||
paths =
|
||||
ArrayUtils.addAll(
|
||||
m.getAnnotation(PostMapping.class).value(),
|
||||
m.getAnnotation(PostMapping.class).path());
|
||||
} else if (m.getAnnotation(GetMapping.class) != null) {
|
||||
paths =
|
||||
ArrayUtils.addAll(
|
||||
m.getAnnotation(GetMapping.class).value(), m.getAnnotation(GetMapping.class).path());
|
||||
} else if (m.getAnnotation(PutMapping.class) != null) {
|
||||
paths =
|
||||
ArrayUtils.addAll(
|
||||
m.getAnnotation(PutMapping.class).value(), m.getAnnotation(PutMapping.class).path());
|
||||
}
|
||||
if (paths == null) {
|
||||
return null;
|
||||
} else {
|
||||
return Arrays.stream(paths).filter(path -> !"".equals(path)).findFirst().orElse("");
|
||||
}
|
||||
}
|
||||
|
||||
private List<String> getHints(Class<? extends AssignmentEndpoint> e) {
|
||||
if (e.isAnnotationPresent(AssignmentHints.class)) {
|
||||
return List.of(e.getAnnotationsByType(AssignmentHints.class)[0].value());
|
||||
}
|
||||
return Collections.emptyList();
|
||||
private List<String> getHints(Class<? extends AssignmentEndpoint> e) {
|
||||
if (e.isAnnotationPresent(AssignmentHints.class)) {
|
||||
return List.of(e.getAnnotationsByType(AssignmentHints.class)[0].value());
|
||||
}
|
||||
return Collections.emptyList();
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,28 +1,28 @@
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
*
|
||||
* Copyright (c) 2002 - 2014 Bruce Mayhew
|
||||
*
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
*
|
||||
*/
|
||||
|
||||
package org.owasp.webgoat.container.lessons;
|
||||
@ -30,7 +30,7 @@ package org.owasp.webgoat.container.lessons;
|
||||
import lombok.Value;
|
||||
|
||||
/**
|
||||
* <p>Hint class.</p>
|
||||
* Hint class.
|
||||
*
|
||||
* @author rlawson
|
||||
* @version $Id: $Id
|
||||
@ -38,6 +38,6 @@ import lombok.Value;
|
||||
@Value
|
||||
public class Hint {
|
||||
|
||||
private String hint;
|
||||
private String assignmentPath;
|
||||
private String hint;
|
||||
private String assignmentPath;
|
||||
}
|
||||
|
||||
@ -3,10 +3,10 @@ package org.owasp.webgoat.container.lessons;
|
||||
import org.owasp.webgoat.container.users.WebGoatUser;
|
||||
|
||||
/**
|
||||
* Interface for initialization of a lesson. It is called when a new user is added to WebGoat and when a users
|
||||
* reset a lesson. Make sure to clean beforehand and then re-initialize the lesson.
|
||||
* Interface for initialization of a lesson. It is called when a new user is added to WebGoat and
|
||||
* when a users reset a lesson. Make sure to clean beforehand and then re-initialize the lesson.
|
||||
*/
|
||||
public interface Initializeable {
|
||||
|
||||
void initialize(WebGoatUser webGoatUser);
|
||||
void initialize(WebGoatUser webGoatUser);
|
||||
}
|
||||
|
||||
@ -22,115 +22,103 @@
|
||||
|
||||
package org.owasp.webgoat.container.lessons;
|
||||
|
||||
import java.util.List;
|
||||
import lombok.Getter;
|
||||
import lombok.Setter;
|
||||
|
||||
import java.util.List;
|
||||
|
||||
@Getter
|
||||
@Setter
|
||||
public abstract class Lesson {
|
||||
|
||||
private static int count = 1;
|
||||
private Integer id = null;
|
||||
private List<Assignment> assignments;
|
||||
private static int count = 1;
|
||||
private Integer id = null;
|
||||
private List<Assignment> assignments;
|
||||
|
||||
/**
|
||||
* Constructor for the Lesson object
|
||||
*/
|
||||
protected Lesson() {
|
||||
id = ++count;
|
||||
}
|
||||
/** Constructor for the Lesson object */
|
||||
protected Lesson() {
|
||||
id = ++count;
|
||||
}
|
||||
|
||||
/**
|
||||
* getName.
|
||||
*
|
||||
* @return a {@link java.lang.String} object.
|
||||
*/
|
||||
public String getName() {
|
||||
String className = getClass().getName();
|
||||
return className.substring(className.lastIndexOf('.') + 1);
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>getName.</p>
|
||||
*
|
||||
* @return a {@link java.lang.String} object.
|
||||
*/
|
||||
public String getName() {
|
||||
String className = getClass().getName();
|
||||
return className.substring(className.lastIndexOf('.') + 1);
|
||||
}
|
||||
/**
|
||||
* Gets the category attribute of the Lesson object
|
||||
*
|
||||
* @return The category value
|
||||
*/
|
||||
public Category getCategory() {
|
||||
return getDefaultCategory();
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the category attribute of the Lesson object
|
||||
*
|
||||
* @return The category value
|
||||
*/
|
||||
public Category getCategory() {
|
||||
return getDefaultCategory();
|
||||
}
|
||||
/**
|
||||
* getDefaultCategory.
|
||||
*
|
||||
* @return a {@link org.owasp.webgoat.container.lessons.Category} object.
|
||||
*/
|
||||
protected abstract Category getDefaultCategory();
|
||||
|
||||
/**
|
||||
* <p>getDefaultCategory.</p>
|
||||
*
|
||||
* @return a {@link org.owasp.webgoat.container.lessons.Category} object.
|
||||
*/
|
||||
protected abstract Category getDefaultCategory();
|
||||
/**
|
||||
* Gets the title attribute of the HelloScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public abstract String getTitle();
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the HelloScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public abstract String getTitle();
|
||||
/**
|
||||
* Returns the default "path" portion of a lesson's URL.
|
||||
*
|
||||
* <p>
|
||||
*
|
||||
* <p>Legacy webgoat lesson links are of the form "attack?Screen=Xmenu=Ystage=Z". This method
|
||||
* returns the path portion of the url, i.e., "attack" in the string above.
|
||||
*
|
||||
* <p>Newer, Spring-Controller-based classes will override this method to return "*.do"-styled
|
||||
* paths.
|
||||
*
|
||||
* @return a {@link java.lang.String} object.
|
||||
*/
|
||||
protected String getPath() {
|
||||
return "#lesson/";
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>Returns the default "path" portion of a lesson's URL.</p>
|
||||
* <p>
|
||||
* <p>
|
||||
* Legacy webgoat lesson links are of the form
|
||||
* "attack?Screen=Xmenu=Ystage=Z". This method returns the path portion of
|
||||
* the url, i.e., "attack" in the string above.
|
||||
* <p>
|
||||
* Newer, Spring-Controller-based classes will override this method to
|
||||
* return "*.do"-styled paths.
|
||||
*
|
||||
* @return a {@link java.lang.String} object.
|
||||
*/
|
||||
protected String getPath() {
|
||||
return "#lesson/";
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the link that can be used to request this screen.
|
||||
* <p>
|
||||
* Rendering the link in the browser may result in Javascript sending
|
||||
* additional requests to perform necessary actions or to obtain data
|
||||
* relevant to the lesson or the element of the lesson selected by the
|
||||
* user. Thanks to using the hash mark "#" and Javascript handling the
|
||||
* clicks, the user will experience less waiting as the pages do not have
|
||||
* to reload entirely.
|
||||
*
|
||||
* @return a {@link java.lang.String} object.
|
||||
*/
|
||||
public String getLink() {
|
||||
return String.format("%s%s.lesson", getPath(), getId());
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public String toString() {
|
||||
return getTitle();
|
||||
}
|
||||
|
||||
public final String getId() {
|
||||
return this.getClass().getSimpleName();
|
||||
}
|
||||
|
||||
public final String getPackage() {
|
||||
var packageName = this.getClass().getPackageName();
|
||||
//package name is the direct package name below lessons (any subpackage will be removed)
|
||||
return packageName.replaceAll("org.owasp.webgoat.lessons.", "").replaceAll("\\..*", "");
|
||||
|
||||
|
||||
|
||||
}
|
||||
/**
|
||||
* Get the link that can be used to request this screen.
|
||||
*
|
||||
* <p>Rendering the link in the browser may result in Javascript sending additional requests to
|
||||
* perform necessary actions or to obtain data relevant to the lesson or the element of the lesson
|
||||
* selected by the user. Thanks to using the hash mark "#" and Javascript handling the clicks, the
|
||||
* user will experience less waiting as the pages do not have to reload entirely.
|
||||
*
|
||||
* @return a {@link java.lang.String} object.
|
||||
*/
|
||||
public String getLink() {
|
||||
return String.format("%s%s.lesson", getPath(), getId());
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public String toString() {
|
||||
return getTitle();
|
||||
}
|
||||
|
||||
public final String getId() {
|
||||
return this.getClass().getSimpleName();
|
||||
}
|
||||
|
||||
public final String getPackage() {
|
||||
var packageName = this.getClass().getPackageName();
|
||||
// package name is the direct package name below lessons (any subpackage will be removed)
|
||||
return packageName.replaceAll("org.owasp.webgoat.lessons.", "").replaceAll("\\..*", "");
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,39 +1,38 @@
|
||||
package org.owasp.webgoat.container.lessons;
|
||||
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import org.owasp.webgoat.container.users.WebGoatUser;
|
||||
import org.springframework.security.core.context.SecurityContextHolder;
|
||||
|
||||
import java.lang.reflect.InvocationHandler;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.sql.Connection;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import org.owasp.webgoat.container.users.WebGoatUser;
|
||||
import org.springframework.security.core.context.SecurityContextHolder;
|
||||
|
||||
/**
|
||||
* Handler which sets the correct schema for the currently bounded user. This way users are not seeing each other
|
||||
* data and we can reset data for just one particular user.
|
||||
* Handler which sets the correct schema for the currently bounded user. This way users are not
|
||||
* seeing each other data and we can reset data for just one particular user.
|
||||
*/
|
||||
@Slf4j
|
||||
public class LessonConnectionInvocationHandler implements InvocationHandler {
|
||||
|
||||
private final Connection targetConnection;
|
||||
private final Connection targetConnection;
|
||||
|
||||
public LessonConnectionInvocationHandler(Connection targetConnection) {
|
||||
this.targetConnection = targetConnection;
|
||||
}
|
||||
public LessonConnectionInvocationHandler(Connection targetConnection) {
|
||||
this.targetConnection = targetConnection;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
|
||||
var authentication = SecurityContextHolder.getContext().getAuthentication();
|
||||
if (authentication != null && authentication.getPrincipal() instanceof WebGoatUser user) {
|
||||
try (var statement = targetConnection.createStatement()) {
|
||||
statement.execute("SET SCHEMA \"" + user.getUsername() + "\"");
|
||||
}
|
||||
}
|
||||
try {
|
||||
return method.invoke(targetConnection, args);
|
||||
} catch (InvocationTargetException e) {
|
||||
throw e.getTargetException();
|
||||
}
|
||||
@Override
|
||||
public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
|
||||
var authentication = SecurityContextHolder.getContext().getAuthentication();
|
||||
if (authentication != null && authentication.getPrincipal() instanceof WebGoatUser user) {
|
||||
try (var statement = targetConnection.createStatement()) {
|
||||
statement.execute("SET SCHEMA \"" + user.getUsername() + "\"");
|
||||
}
|
||||
}
|
||||
try {
|
||||
return method.invoke(targetConnection, args);
|
||||
} catch (InvocationTargetException e) {
|
||||
throw e.getTargetException();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -4,7 +4,7 @@ import lombok.AllArgsConstructor;
|
||||
import lombok.Getter;
|
||||
|
||||
/**
|
||||
* <p>LessonInfoModel class.</p>
|
||||
* LessonInfoModel class.
|
||||
*
|
||||
* @author dm
|
||||
* @version $Id: $Id
|
||||
@ -13,9 +13,8 @@ import lombok.Getter;
|
||||
@AllArgsConstructor
|
||||
public class LessonInfoModel {
|
||||
|
||||
private String lessonTitle;
|
||||
private boolean hasSource;
|
||||
private boolean hasSolution;
|
||||
private boolean hasPlan;
|
||||
|
||||
private String lessonTitle;
|
||||
private boolean hasSource;
|
||||
private boolean hasSolution;
|
||||
private boolean hasPlan;
|
||||
}
|
||||
|
||||
@ -1,166 +1,162 @@
|
||||
/**
|
||||
* *************************************************************************************************
|
||||
*
|
||||
* <p>
|
||||
* <p>
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
* <p>
|
||||
* Copyright (c) 2002 - 2014 Bruce Mayhew
|
||||
* <p>
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
* <p>
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
* <p>
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
* <p>
|
||||
* Getting Source ==============
|
||||
* <p>
|
||||
* Source for this application is maintained at
|
||||
* https://github.com/WebGoat/WebGoat, a repository for free software projects.
|
||||
*
|
||||
* <p>This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* <p>Copyright (c) 2002 - 2014 Bruce Mayhew
|
||||
*
|
||||
* <p>This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* <p>This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
|
||||
* without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* <p>You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* <p>Getting Source ==============
|
||||
*
|
||||
* <p>Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
|
||||
* for free software projects.
|
||||
*/
|
||||
|
||||
package org.owasp.webgoat.container.lessons;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* <p>LessonMenuItem class.</p>
|
||||
* LessonMenuItem class.
|
||||
*
|
||||
* @author rlawson
|
||||
* @version $Id: $Id
|
||||
*/
|
||||
public class LessonMenuItem {
|
||||
|
||||
private String name;
|
||||
private LessonMenuItemType type;
|
||||
private List<LessonMenuItem> children = new ArrayList<>();
|
||||
private boolean complete;
|
||||
private String link;
|
||||
private int ranking;
|
||||
private String name;
|
||||
private LessonMenuItemType type;
|
||||
private List<LessonMenuItem> children = new ArrayList<>();
|
||||
private boolean complete;
|
||||
private String link;
|
||||
private int ranking;
|
||||
|
||||
/**
|
||||
* <p>Getter for the field <code>name</code>.</p>
|
||||
*
|
||||
* @return the name
|
||||
*/
|
||||
public String getName() {
|
||||
return name;
|
||||
}
|
||||
/**
|
||||
* Getter for the field <code>name</code>.
|
||||
*
|
||||
* @return the name
|
||||
*/
|
||||
public String getName() {
|
||||
return name;
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>Setter for the field <code>name</code>.</p>
|
||||
*
|
||||
* @param name the name to set
|
||||
*/
|
||||
public void setName(String name) {
|
||||
this.name = name;
|
||||
}
|
||||
/**
|
||||
* Setter for the field <code>name</code>.
|
||||
*
|
||||
* @param name the name to set
|
||||
*/
|
||||
public void setName(String name) {
|
||||
this.name = name;
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>Getter for the field <code>children</code>.</p>
|
||||
*
|
||||
* @return the children
|
||||
*/
|
||||
public List<LessonMenuItem> getChildren() {
|
||||
return children;
|
||||
}
|
||||
/**
|
||||
* Getter for the field <code>children</code>.
|
||||
*
|
||||
* @return the children
|
||||
*/
|
||||
public List<LessonMenuItem> getChildren() {
|
||||
return children;
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>Setter for the field <code>children</code>.</p>
|
||||
*
|
||||
* @param children the children to set
|
||||
*/
|
||||
public void setChildren(List<LessonMenuItem> children) {
|
||||
this.children = children;
|
||||
}
|
||||
/**
|
||||
* Setter for the field <code>children</code>.
|
||||
*
|
||||
* @param children the children to set
|
||||
*/
|
||||
public void setChildren(List<LessonMenuItem> children) {
|
||||
this.children = children;
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>Getter for the field <code>type</code>.</p>
|
||||
*
|
||||
* @return the type
|
||||
*/
|
||||
public LessonMenuItemType getType() {
|
||||
return type;
|
||||
}
|
||||
/**
|
||||
* Getter for the field <code>type</code>.
|
||||
*
|
||||
* @return the type
|
||||
*/
|
||||
public LessonMenuItemType getType() {
|
||||
return type;
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>Setter for the field <code>type</code>.</p>
|
||||
*
|
||||
* @param type the type to set
|
||||
*/
|
||||
public void setType(LessonMenuItemType type) {
|
||||
this.type = type;
|
||||
}
|
||||
/**
|
||||
* Setter for the field <code>type</code>.
|
||||
*
|
||||
* @param type the type to set
|
||||
*/
|
||||
public void setType(LessonMenuItemType type) {
|
||||
this.type = type;
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>addChild.</p>
|
||||
*
|
||||
* @param child a {@link LessonMenuItem} object.
|
||||
*/
|
||||
public void addChild(LessonMenuItem child) {
|
||||
children.add(child);
|
||||
}
|
||||
/**
|
||||
* addChild.
|
||||
*
|
||||
* @param child a {@link LessonMenuItem} object.
|
||||
*/
|
||||
public void addChild(LessonMenuItem child) {
|
||||
children.add(child);
|
||||
}
|
||||
|
||||
@Override
|
||||
public String toString() {
|
||||
StringBuilder bldr = new StringBuilder();
|
||||
bldr.append("Name: ").append(name).append(" | ");
|
||||
bldr.append("Type: ").append(type).append(" | ");
|
||||
return bldr.toString();
|
||||
}
|
||||
@Override
|
||||
public String toString() {
|
||||
StringBuilder bldr = new StringBuilder();
|
||||
bldr.append("Name: ").append(name).append(" | ");
|
||||
bldr.append("Type: ").append(type).append(" | ");
|
||||
return bldr.toString();
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>isComplete.</p>
|
||||
*
|
||||
* @return the complete
|
||||
*/
|
||||
public boolean isComplete() {
|
||||
return complete;
|
||||
}
|
||||
/**
|
||||
* isComplete.
|
||||
*
|
||||
* @return the complete
|
||||
*/
|
||||
public boolean isComplete() {
|
||||
return complete;
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>Setter for the field <code>complete</code>.</p>
|
||||
*
|
||||
* @param complete the complete to set
|
||||
*/
|
||||
public void setComplete(boolean complete) {
|
||||
this.complete = complete;
|
||||
}
|
||||
/**
|
||||
* Setter for the field <code>complete</code>.
|
||||
*
|
||||
* @param complete the complete to set
|
||||
*/
|
||||
public void setComplete(boolean complete) {
|
||||
this.complete = complete;
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>Getter for the field <code>link</code>.</p>
|
||||
*
|
||||
* @return the link
|
||||
*/
|
||||
public String getLink() {
|
||||
return link;
|
||||
}
|
||||
/**
|
||||
* Getter for the field <code>link</code>.
|
||||
*
|
||||
* @return the link
|
||||
*/
|
||||
public String getLink() {
|
||||
return link;
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>Setter for the field <code>link</code>.</p>
|
||||
*
|
||||
* @param link the link to set
|
||||
*/
|
||||
public void setLink(String link) {
|
||||
this.link = link;
|
||||
}
|
||||
|
||||
public void setRanking(int ranking) {
|
||||
this.ranking = ranking;
|
||||
}
|
||||
|
||||
public int getRanking() {
|
||||
return this.ranking;
|
||||
}
|
||||
/**
|
||||
* Setter for the field <code>link</code>.
|
||||
*
|
||||
* @param link the link to set
|
||||
*/
|
||||
public void setLink(String link) {
|
||||
this.link = link;
|
||||
}
|
||||
|
||||
public void setRanking(int ranking) {
|
||||
this.ranking = ranking;
|
||||
}
|
||||
|
||||
public int getRanking() {
|
||||
return this.ranking;
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,40 +1,40 @@
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
*
|
||||
* Copyright (c) 2002 - 2014 Bruce Mayhew
|
||||
*
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
*
|
||||
*/
|
||||
|
||||
package org.owasp.webgoat.container.lessons;
|
||||
|
||||
/**
|
||||
* <p>LessonMenuItemType class.</p>
|
||||
* LessonMenuItemType class.
|
||||
*
|
||||
* @author rlawson
|
||||
* @version $Id: $Id
|
||||
*/
|
||||
public enum LessonMenuItemType {
|
||||
CATEGORY,
|
||||
LESSON,
|
||||
STAGE
|
||||
CATEGORY,
|
||||
LESSON,
|
||||
STAGE
|
||||
}
|
||||
|
||||
@ -1,46 +1,42 @@
|
||||
package org.owasp.webgoat.container.lessons;
|
||||
|
||||
import lombok.Getter;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import org.springframework.core.io.ClassPathResource;
|
||||
import org.springframework.core.io.support.ResourcePatternResolver;
|
||||
import org.springframework.stereotype.Component;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.util.ArrayList;
|
||||
import java.util.HashSet;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
import java.util.regex.Pattern;
|
||||
import lombok.Getter;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import org.springframework.core.io.support.ResourcePatternResolver;
|
||||
import org.springframework.stereotype.Component;
|
||||
|
||||
@Component
|
||||
@Slf4j
|
||||
public class LessonScanner {
|
||||
|
||||
private static final Pattern lessonPattern = Pattern.compile("^.*/lessons/([^/]*)/.*$");
|
||||
private static final Pattern lessonPattern = Pattern.compile("^.*/lessons/([^/]*)/.*$");
|
||||
|
||||
@Getter
|
||||
private final Set<String> lessons = new HashSet<>();
|
||||
@Getter private final Set<String> lessons = new HashSet<>();
|
||||
|
||||
public LessonScanner(ResourcePatternResolver resourcePatternResolver) {
|
||||
try {
|
||||
var resources = resourcePatternResolver.getResources("classpath:/lessons/*/*");
|
||||
for (var resource : resources) {
|
||||
//WG can run as a fat jar or as directly from file system we need to support both so use the URL
|
||||
var url = resource.getURL();
|
||||
var matcher = lessonPattern.matcher(url.toString());
|
||||
if (matcher.matches()) {
|
||||
lessons.add(matcher.group(1));
|
||||
}
|
||||
}
|
||||
log.debug("Found {} lessons", lessons.size());
|
||||
} catch (IOException e) {
|
||||
log.warn("No lessons found...");
|
||||
public LessonScanner(ResourcePatternResolver resourcePatternResolver) {
|
||||
try {
|
||||
var resources = resourcePatternResolver.getResources("classpath:/lessons/*/*");
|
||||
for (var resource : resources) {
|
||||
// WG can run as a fat jar or as directly from file system we need to support both so use
|
||||
// the URL
|
||||
var url = resource.getURL();
|
||||
var matcher = lessonPattern.matcher(url.toString());
|
||||
if (matcher.matches()) {
|
||||
lessons.add(matcher.group(1));
|
||||
}
|
||||
|
||||
}
|
||||
log.debug("Found {} lessons", lessons.size());
|
||||
} catch (IOException e) {
|
||||
log.warn("No lessons found...");
|
||||
}
|
||||
}
|
||||
|
||||
public List<String> applyPattern(String pattern) {
|
||||
return lessons.stream().map(lesson -> String.format(pattern, lesson)).toList();
|
||||
}
|
||||
public List<String> applyPattern(String pattern) {
|
||||
return lessons.stream().map(lesson -> String.format(pattern, lesson)).toList();
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user