- Field1: exactly three lowercase characters(^[a-z]{3}$)
+ Field 1: exactly three lowercase characters(^[a-z]{3}$)
-
Field2: exactly three digits(^[0-9]{3}$)
+
Field 2: exactly three digits(^[0-9]{3}$)
-
Field3: letters, numbers, and space only(^[a-zA-Z0-9 ]*$)
+
Field 3: letters, numbers, and space only(^[a-zA-Z0-9 ]*$)
-
Field4: enumeration of numbers (^(one|two|three|four|five|six|seven|eight|nine)$)
+
Field 4: enumeration of numbers (^(one|two|three|four|five|six|seven|eight|nine)$)
-
Field5: simple zip code (^\d{5}$)
+
Field 5: simple zip code (^\d{5}$)
-
Field6: zip with optional dash four (^\d{5}(-\d{4})?$)
+
Field 6: zip with optional dash four (^\d{5}(-\d{4})?$)
-
Field7: US phone number with or without dashes (^[2-9]\d{2}-?\d{3}-?\d{4}$)
+
Field 7: US phone number with or without dashes (^[2-9]\d{2}-?\d{3}-?\d{4}$)
-
+
+
+
diff --git a/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FrontendValidation.adoc b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FrontendValidation.adoc
index 2f02262d0..67b4dd857 100644
--- a/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FrontendValidation.adoc
+++ b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FrontendValidation.adoc
@@ -1,4 +1,5 @@
== Validation
+
Often, there is some mechanism in place to prevent users from sending altered
field values to server, such as validation before sending. Most of popular browsers
such as Chrome don't allow editing scripts during runtime. We will have to circumvent
diff --git a/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_Intro.adoc b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_Intro.adoc
index 5743d6f9a..e75483bc8 100755
--- a/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_Intro.adoc
+++ b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_Intro.adoc
@@ -1,10 +1,11 @@
-
== Concept
+
Users have a great degree of control over the front-end of the web application.
They can alter HTML code, sometimes also scripts. This is why
apps that require certain format of input should also validate on server-side.
== Goals
+
* The user should have a basic knowledge of HTML
* The user should be able to tamper a request before sending (with proxy or other tool)
* The user will be able to tamper with field restrictions and bypass client-side validation
diff --git a/webgoat-lessons/bypass-restrictions/src/test/java/org/owasp/webgoat/plugin/BypassRestrictionsFrontendValidationTest.java b/webgoat-lessons/bypass-restrictions/src/test/java/org/owasp/webgoat/plugin/BypassRestrictionsFrontendValidationTest.java
new file mode 100644
index 000000000..8fb0657fa
--- /dev/null
+++ b/webgoat-lessons/bypass-restrictions/src/test/java/org/owasp/webgoat/plugin/BypassRestrictionsFrontendValidationTest.java
@@ -0,0 +1,76 @@
+package org.owasp.webgoat.plugin;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.owasp.webgoat.plugins.LessonTest;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
+import org.springframework.test.web.servlet.result.MockMvcResultHandlers;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+
+import static org.hamcrest.Matchers.is;
+import static org.mockito.Mockito.when;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+/**
+ * @author nbaars
+ * @since 6/16/17.
+ */
+@RunWith(SpringJUnit4ClassRunner.class)
+public class BypassRestrictionsFrontendValidationTest extends LessonTest {
+
+ @Before
+ public void setup() throws Exception {
+ when(webSession.getCurrentLesson()).thenReturn(new BypassRestrictions());
+ this.mockMvc = MockMvcBuilders.webAppContextSetup(this.wac).build();
+ }
+
+ @Test
+ public void noChangesShouldNotPassTheLesson() throws Exception {
+ mockMvc.perform(MockMvcRequestBuilders.post("/BypassRestrictions/frontendValidation")
+ .param("field1", "abc")
+ .param("field2", "123")
+ .param("field3", "abc ABC 123")
+ .param("field4", "seven")
+ .param("field5", "01101")
+ .param("field6", "90201 1111")
+ .param("field7", "301-604-4882")
+ .param("error", "2"))
+ .andDo(MockMvcResultHandlers.print())
+ .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false)));
+ }
+
+ @Test
+ public void bypassAllFieldShouldPass() throws Exception {
+ mockMvc.perform(MockMvcRequestBuilders.post("/BypassRestrictions/frontendValidation")
+ .param("field1", "abcd")
+ .param("field2", "1234")
+ .param("field3", "abc $ABC 123")
+ .param("field4", "ten")
+ .param("field5", "01101AA")
+ .param("field6", "90201 1111AA")
+ .param("field7", "301-604-4882$$")
+ .param("error", "0"))
+ .andDo(MockMvcResultHandlers.print())
+ .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(true)));
+ }
+
+ @Test
+ public void notBypassingAllFieldShouldNotPass() throws Exception {
+ mockMvc.perform(MockMvcRequestBuilders.post("/BypassRestrictions/frontendValidation")
+ .param("field1", "abc")
+ .param("field2", "1234")
+ .param("field3", "abc $ABC 123")
+ .param("field4", "ten")
+ .param("field5", "01101AA")
+ .param("field6", "90201 1111AA")
+ .param("field7", "301-604-4882AA")
+ .param("error", "0"))
+ .andDo(MockMvcResultHandlers.print())
+ .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false)));
+ }
+
+
+}
\ No newline at end of file