Detailed new lesson instructions

git-svn-id: http://webgoat.googlecode.com/svn/trunk@120 4033779f-a91e-0410-96ef-6bf7bf53c507

webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/LessonAdapter.java

@@ -73,7 +73,7 @@ public abstract class LessonAdapter extends AbstractLesson
 	ec
 		.addElement(new Center().addElement(new H3()
 			.addElement(new StringElement(
-				"This lesson needs a creator."))));
+				"Detailed Lesson Creation Instructions."))));
 	ec.addElement(new P());
 	ec
 		.addElement(new StringElement(
@@ -99,7 +99,9 @@ public abstract class LessonAdapter extends AbstractLesson
 		ec.addElement(pre);
 	    }
 	    catch (Exception e)
-	    {}
+	    {
+	    	e.printStackTrace();
+	    }
 	}
 	return (ec);
     }

webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/NewLesson.java

@@ -46,9 +46,10 @@ public class NewLesson extends LessonAdapter
      */
     protected Element createContent(WebSession s)
     {
-	// just to get the generic how to text.
+	return super.createContent(s);
-	makeSuccess(s);
+	//makeSuccess(s);
-	return (new StringElement("Welcome to the WebGoat hall of fame !!"));
+	//ec.addElement(new StringElement("Welcome to the WebGoat hall of fame !!"));
+	//return (ec);
     }
 
 
@@ -80,4 +81,10 @@ public class NewLesson extends LessonAdapter
     {
 	return ("How to add a new WebGoat lesson");
     }
+    
+    public Element getCredits()
+    {
+	return super.getCustomCredits("Created by: Your name goes here!", new StringElement(""));
+    }
+
 }

webgoat/main/project/WebContent/lesson_plans/NewLesson.html

@@ -6,18 +6,11 @@
 <!-- Start Instructions -->
 Adding lessons to WebGoat is very easy. If you have an idea that would be suitable<br> 
 for a new lesson, follow these few simple instructions to implement it:<br><br>
-* Download the source code from <a href="http://sourceforge.net/project/showfiles.php?group_id=64424&package_id=61824">here.</a><br><br>
+* Download the source code from <a href="http://code.google.com/p/webgoat/">here.</a><br><br>
 * Setup framework: follow the simple instructions in "HOW TO create the WebGoat workspace.txt" that comes with the project.<br><br>
 * You need to add two files for each new lesson: <br>
 &nbsp;&nbsp;- YourLesson.java to org.owasp.webgoat.lessons<br>
 &nbsp;&nbsp;- YourLesson.html to WebContent/lesson_plans<br><br>
-* YourLesson class must implement LessonAdapter and override the following methods:<br>
-&nbsp;- createContent: Use the <a href="http://jakarta.apache.org/site/downloads/downloads_ecs.cgi">ECS package</a> to develop HTML presented to the user.<br>
-&nbsp;- getCategory: Returns the category for which this lesson belongs (XSS, Injection flaws..etc)<br>
-&nbsp;- getHints: List of hints you would like to pass on to the users to point them in the right direction.<br>
-&nbsp;- getTitle: The title for your new lesson.<br>
-&nbsp;- getCredits: Your name goes here.<br><br>
-
 <!-- Stop Instructions -->
 <br>
  

webgoat/main/project/doc/New Lesson Instructions.txt

@@ -1,63 +1,55 @@
-How to write a new WebGoat lesson
+Detailed instructions for adding a lesson
 
 All you have to do is implement the abstract methods in LessonAdapter.  
 Follow the outline below.
 
 WebGoat uses the Element Construction Set from the Jakarta project.  
 You should read up on the API for ECS at 
-http://www.peerfear.org/alexandria/content/html/javadoc/ecs/HEAD/index.html.
+http://jakarta.apache.org/site/downloads/downloads_ecs.cgi.
 In addition you can look at the other lessons for examples of how to use the ECS.
 
 
 
 Step 1: Set up the framework
 
-		import java.util.*;
+import java.util.*;
-		import org.apache.ecs.*;
+import org.apache.ecs.*;
-		import org.apache.ecs.html.*;
+import org.apache.ecs.html.*;
-		
+
-		/**
+// Add copyright text - use text from another lesson 
-		 *  Copyright (c) 2002 Free Software Foundation developed under the 
+
-		 *  custody of the Open Web Application Security Project 
+public class NewLesson extends LessonAdapter
-		 *  (http://www.owasp.org) This software package is published by OWASP
+{
-		 *  under the GPL. You should read and accept the LICENSE before you 
+
-		 *  use, modify and/or redistribute this software.
+	protected Element createContent(WebSession s)
-		 *
+	{
-		 * @author     jwilliams@aspectsecurity.com
+		return( new StringElement( "Hello World" ) );
-		 * @created    November 6, 2002
+	}
-		 */
+
-		public class NewLesson extends LessonAdapter
+	public String getCategory()
-		{
+	{
-		
+	}
-			protected Element createContent(WebSession s)
+
-			{
+	protected List getHints()
-				return( new StringElement( "Hello World" ) );
+	{
-			}
+	}
-		
+
-			public String getCategory()
+	protected String getInstructions()
-			{
+	{
-			}
+	}
-		
+
-			protected List getHints()
+	protected Element getMenuItem()
-			{
+	{
-			}
+	}
-		
+
-			protected String getInstructions()
+	protected Integer getRanking()
-			{
+	{
-			}
+	}
-		
+
-			protected Element getMenuItem()
+	public String getTitle()
-			{
+	{
-			}
+	}
-		
+}
-			protected Integer getRanking()
-			{
-			}
-		
-			public String getTitle()
-			{
-			}
-		}
 		
 
 
@@ -71,124 +63,117 @@ should be handled on a single page, so you'll need to design your lesson to
 work that way.  A good generic pattern for the createContent method is shown 
 below:
 
-	// define a constant for the field name
+// define a constant for the field name
-	private static final String INPUT = "input";
+private static final String INPUT = "input";
-		
-	protected Element createContent(WebSession s)
-	{
-		ElementContainer ec = new ElementContainer();
-		try
-		{
-			// get some input from the user -- see ParameterParser for details
-			String userInput = s.getParser().getStringParameter(INPUT, "");
-
-			// do something with the input
-			//   -- SQL query?
-			//   -- Runtime.exec?
-			//   -- Some other dangerous thing
-				
-			// generate some output -- a string and an input field
-			ec.addElement(new StringElement("Enter a string: "));
-			ec.addElement( new Input(Input.TEXT, INPUT, userInput) );
-				
-			// Tell the lesson tracker the lesson has completed.
-			// This should occur when the user has 'hacked' the lesson.
-			getLessonTracker(  s ).setCompleted( true );
-
-		}
-		catch (Exception e)
-		{
-			s.setMessage("Error generating " + this.getClass().getName());
-			e.printStackTrace();
-		}
-		return (ec);
-	}
 	
-ECS is quite powerful -- see the Encoding lesson for an example of how to use 
+protected Element createContent(WebSession s)
-it to create a table with rows and rows of output.
+{
+	ElementContainer ec = new ElementContainer();
+	try
+	{
+		// get some input from the user -- see ParameterParser 
+		// for details
+		String userInput = s.getParser().getStringParameter(INPUT, "");
+
+		// do something with the input
+		//   -- SQL query?
+		//   -- Runtime.exec?
+		//   -- Some other dangerous thing
+			
+		// generate some output -- a string and an input field
+		ec.addElement(new StringElement("Enter a string: "));
+		ec.addElement( new Input(Input.TEXT, INPUT, userInput) );
+			
+		// Tell the lesson tracker the lesson has completed.
+		// This should occur when the user has 'hacked' the lesson.
+		makeSuccess(s);
+
+	}
+	catch (Exception e)
+	{
+		s.setMessage("Error generating " + this.getClass().getName());
+		e.printStackTrace();
+	}
+	return (ec);
+}
+	
+ECS is quite powerful -- see the Encoding lesson for an example of how 
+to use it to create a table with rows and rows of output.
 
 
 Step 3: Implement the other methods
 
-The other methods in the LessonAdapter class help the lesson plug into the overall
+The other methods in the LessonAdapter class help the lesson plug into 
-WebGoat framework.  They are simple and should only take a few minutes to implement.
+the overall WebGoat framework.  They are simple and should only take a 
+few minutes to implement.
 
-		public String getCategory()
+public String getCategory()
-		{
+{
-			// The default category is "General" Only override this
+	// The default category is "General" Only override this
-			// method if you wish to create a new category or if you
+	// method if you wish to create a new category or if you
-			// wish this lesson to reside within a category other the
+	// wish this lesson to reside within a category other the
-			// "General"
+	// "General"
-				
-			return( "NewCategory" );  // or use an existing category
-		}
 		
-		protected List getHints()
+	return( "NewCategory" );  // or use an existing category
-		{
+}
-			// Hints will be returned to the user in the order they 
-			// appear below.  The user must click on the "next hint"
-			// button before the hint will be displayed.
-				
-			List hints = new ArrayList();
-			hints.add("A general hint to put users on the right track");
-			hints.add("A hint that gives away a little piece of the problem");
-			hints.add("A hint that basically gives the answer");
-			return hints;
-		}
-		
-		protected String getInstructions()
-		{
-			// Instructions will rendered as html and will appear below
-			// the area and above the actual lesson area.
-			// Instructions should provide the user with the general setup
-			// and goal of the lesson.
-				
-			return("The text that goes at the top of the page");
-		}
-		
-		protected Element getMenuItem()
-		{
-			// This is the text of the link that will appear on
-			// the left hand menus under the appropriate category.
-			// Their is a limited amount of horizontal space in
-			// this area before wrapping will occur.
-				
-			return( "MyLesson" );
-		}
-		
-		protected Integer getRanking()
-		{
-			// The ranking denotes the order in which the menu item
-			// will appear in menu list for each category.  The lowest
-			// number will appear as the first lesson.
-				
-			return new Integer(10);
-		}
 
-		public String getTitle()
+protected List getHints()
-		{
+{
-			// The title of the lesson.  This will appear above the
+	// Hints will be returned to the user in the order they 
-			// control area at the top of the page.  This field will
+	// appear below.  The user must click on the "next hint"
-			// be rendered as html.
+	// button before the hint will be displayed.
-				
+		
-			return ("My Lesson's Short Title");
+	List hints = new ArrayList();
-		}
+	hints.add("A general hint to put users on the right track");
+	hints.add("A hint that gives away a little piece of the problem");
+	hints.add("A hint that basically gives the answer");
+	return hints;
+}
+
+protected String getInstructions()
+{
+	// Instructions will rendered as html and will appear below
+	// the area and above the actual lesson area.
+	// Instructions should provide the user with the general setup
+	// and goal of the lesson.
+		
+	return("The text that goes at the top of the page");
+}
+
+protected Element getMenuItem()
+{
+	// This is the text of the link that will appear on
+	// the left hand menus under the appropriate category.
+	// Their is a limited amount of horizontal space in
+	// this area before wrapping will occur.
+		
+	return( "MyLesson" );
+}
+
+protected Integer getRanking()
+{
+	// The ranking denotes the order in which the menu item
+	// will appear in menu list for each category.  The lowest
+	// number will appear as the first lesson.
+		
+	return new Integer(10);
+}
+
+public String getTitle()
+{
+	// The title of the lesson.  This will appear above the
+	// control area at the top of the page.  This field will
+	// be rendered as html.
+		
+	return ("My Lesson's Short Title");
+}
 
 
 Step 4: Build and test
 
-Once you've implemented your new lesson, you can use ant to build and deploy 
+Once you've implemented your new lesson, you can test the lesson by
-your new web application.  First you want to remove the webgoat .war *AND* 
+starting the Tomcat server (within Eclipse). See the
-the webgoat directory from your webapps directory.  Then, from your webgoat 
+"HOW TO create the WebGoat workspace.txt" document in the WebGoat root.
-directory, type:
-
-	> ant install
-	
-This will compile your new lesson and "install" the path into Tomcat.  
-You only need to "install" once.  If you make changes to the web application 
-and want to test them, you can use:
-
-	> ant reload