diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java index 8731fd565..4847e0bbc 100644 --- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java @@ -22,15 +22,12 @@ import java.util.regex.Pattern; @AssignmentHints(value = {"SqlStringInjectionHint-mitigation-10b-1", "SqlStringInjectionHint-mitigation-10b-2", "SqlStringInjectionHint-mitigation-10b-3"}) public class SqlInjectionLesson10b extends AssignmentEndpoint { - // Problem: Form has two submits, first submit is null and already wants to throw an attack result. Seconds attack result cant be thrown @RequestMapping(method = RequestMethod.POST) @ResponseBody - public AttackResult completed(HttpServletRequest req) { - String editor = req.getParameter("editor"); + public AttackResult completed(@RequestParam String editor) { try { - if (editor == null) { - throw new Exception(); - } + if (editor.isEmpty()) return trackProgress(failed().feedback("sql-injection.10b.no-code").build()); + String regex1 = "(?=.*PreparedStatement.*)(?=.*setString.*)(?=.*\\=\\?.*|.*\\=\\s\\?.*)"; editor = editor.replaceAll("\\<.*?>", ""); boolean hasImportant = this.check_text(regex1, editor.replace("\n", "").replace("\r", "")); @@ -38,12 +35,12 @@ public class SqlInjectionLesson10b extends AssignmentEndpoint { String errors = ""; if (hasImportant && hasCompiled.size() < 1) { return trackProgress(success().feedback("sql-injection.10b.success").build()); - } else if (hasCompiled.size() > 1) { + } else if (hasCompiled.size() > 0) { for (Diagnostic d : hasCompiled) { errors += d.getMessage(null) + "\n"; } } - return trackProgress(failed().feedback("sql-injection.10b.failed").output(errors).build()); + return trackProgress(failed().feedback("sql-injection.10b.failed").output(errors.replace("\n", "
")).build()); } catch(Exception e) { return trackProgress(success().build()); } diff --git a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html index 5bd679b8b..0a0861814 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html +++ b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html @@ -1,7 +1,7 @@ - +
diff --git a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html index c00ffd5ca..6f17f56ea 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html +++ b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html @@ -1,7 +1,7 @@ - +
@@ -41,26 +41,20 @@
-
-
-
+
+
-
+
-
-
- - + +
+

-
+
diff --git a/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties index a6183f6e4..8cbf25fa0 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties +++ b/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties @@ -7,11 +7,10 @@ SqlInjectionChallenge1=Look at the different response you receive from the serve SqlInjectionChallenge2=The vulnerability is on the register form SqlInjectionChallenge3=Use tooling to automate this attack sql-injection.error= +NoResultsMatched= -NoResultsMatched=No results matched. Try Again. - -sql-injection.2.success=You have succeeded! -sql-injection.2.failed=Something went wrong! You got no results, check your SQL Statement and the table above +sql-injection.2.success= +sql-injection.2.failed= SqlStringInjectionHint2-1=You want the data from the column with the name department. You know the database name (employees) and you know the first- and lastname of the employee (first_name, last_name). SqlStringInjectionHint2-2=SELECT column FROM tablename WHERE condition; @@ -24,28 +23,27 @@ SqlStringInjectionHint4-3=ALTER TABLE tablename ADD columnname data type(size); SqlStringInjectionHint5-1=Look at the example. There's everything you'll need. -sql-injection.5a.success=You have succeeded: {0} -sql-injection.5a.no.results=No results matched. Try Again. - -sql-injection.5b.success=You have succeeded: {0} -sql-injection.5b.no.results=No results matched. Try Again. +sql-injection.5a.success= +sql-injection.5a.no.results= +sql-injection.5b.success= +sql-injection.5b.no.results= SqlStringInjectionHint5b1=Try to check which of the input fields is susceptible to an injection attack. SqlStringInjectionHint5b2=Insert 0 or 1 = 1 into the first input field. Th Output should tell you if this field is injectable. SqlStringInjectionHint5b3=The first Input field is not susceptible to sql injection. SqlStringInjectionHint5b4=You don't need to insert any quotations into your injection-string. -sql-injection.6a.success=You have succeeded: {0} -sql-injection.6a.no.results=No results matched. Try Again. +sql-injection.6a.success= +sql-injection.6a.no.results= -sql-injection.advanced.6a.success=You have succeed: {0} -sql-injection.advanced.6a.no.results=No results matched. Try Again. +sql-injection.advanced.6a.success= +sql-injection.advanced.6a.no.results= SqlStringInjectionHint-advanced-6a-1=Try Appending a new SQL Statement to the Query. SqlStringInjectionHint-advanced-6a-2=The new SQL Statement can be really simple like: SELECT ... FROM ... SqlStringInjectionHint-advanced-6a-3=Your new SQL Query should start, with a " ; " and end with " -- " -sql-injection.6b.success=You have succeeded: {0} -sql-injection.6b.no.results=No results matched. Try Again. +sql-injection.6b.success= +sql-injection.6b.no.results= sql-injection.8.success= sql-injection.8.no.results= @@ -66,9 +64,9 @@ SqlStringInjectionHint.9.5=How about something like '; UPDATE employees.... sql-injection.10.success= sql-injection.10.entries= - -sql-injection.10b.success=Your code can prevent an SQL Injection! Success! -sql-injection.10b.failed=Something doesn't seem right with that code. Maybe you should look at an example how to prevent SQL Injections with JDBC? +sql-injection.10b.success= +sql-injection.10b.failed= +sql-injection.10b.no-code= SqlStringInjectionHint.10.1=Use the techniques that you have learned before. SqlStringInjectionHint.10.2=The application takes your input and filters for entries that are LIKE it. diff --git a/webgoat-lessons/sql-injection/src/main/resources/js/assignment10b.js b/webgoat-lessons/sql-injection/src/main/resources/js/assignment10b.js index 907832cf4..42a7da6c2 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/js/assignment10b.js +++ b/webgoat-lessons/sql-injection/src/main/resources/js/assignment10b.js @@ -1,6 +1,20 @@ +$(document).ready( () => { + + var editor = ace.edit("editor"); + editor.setTheme("ace/theme/monokai"); + editor.session.setMode("ace/mode/java"); + + editor.getSession().on("change", () => { + setTimeout( () => { + $("#codesubmit input[name='editor']").val(ace_collect()); + }, 20); + }); + + +}); + function ace_collect() { let code = ""; - console.log("Test"); $(".ace_line").each(function(i, el) { var to_add = el.innerHTML; if(/\/\/.*/.test(to_add)) { @@ -8,18 +22,5 @@ function ace_collect() { } code += to_add; }); - $.ajax({ - type: "POST", - url: "/WebGoat/SqlInjection/attack10b", - dataType: "text", - data: { - editor: code - }, - success: function(data) { - console.log("entry"); - let lesson_feedback = JSON.parse(data); - $("#insertcode .attack-feedback").css("display", "block"); - $("#insertcode .attack-feedback").html(lesson_feedback.feedback); - } - }); + return code; } \ No newline at end of file