- Added testcases for bypassing frontend validation.

- Improved layout of the lesson - Fixed JavaScript issues with 'let'
2017-06-16 01:16:31 +02:00
parent bf210de013
commit edceba73fe
5 changed files with 105 additions and 48 deletions
--- a/webgoat-lessons/bypass-restrictions/src/test/java/org/owasp/webgoat/plugin/BypassRestrictionsFrontendValidationTest.java
+++ b/webgoat-lessons/bypass-restrictions/src/test/java/org/owasp/webgoat/plugin/BypassRestrictionsFrontendValidationTest.java
@ -0,0 +1,76 @@
+package org.owasp.webgoat.plugin;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.owasp.webgoat.plugins.LessonTest;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
+import org.springframework.test.web.servlet.result.MockMvcResultHandlers;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+
+import static org.hamcrest.Matchers.is;
+import static org.mockito.Mockito.when;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+/**
+ * @author nbaars
+ * @since 6/16/17.
+ */
+@RunWith(SpringJUnit4ClassRunner.class)
+public class BypassRestrictionsFrontendValidationTest extends LessonTest {
+
+    @Before
+    public void setup() throws Exception {
+        when(webSession.getCurrentLesson()).thenReturn(new BypassRestrictions());
+        this.mockMvc = MockMvcBuilders.webAppContextSetup(this.wac).build();
+    }
+
+    @Test
+    public void noChangesShouldNotPassTheLesson() throws Exception {
+        mockMvc.perform(MockMvcRequestBuilders.post("/BypassRestrictions/frontendValidation")
+                .param("field1", "abc")
+                .param("field2", "123")
+                .param("field3", "abc ABC 123")
+                .param("field4", "seven")
+                .param("field5", "01101")
+                .param("field6", "90201 1111")
+                .param("field7", "301-604-4882")
+                .param("error", "2"))
+                .andDo(MockMvcResultHandlers.print())
+                .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false)));
+    }
+
+    @Test
+    public void bypassAllFieldShouldPass() throws Exception {
+        mockMvc.perform(MockMvcRequestBuilders.post("/BypassRestrictions/frontendValidation")
+                .param("field1", "abcd")
+                .param("field2", "1234")
+                .param("field3", "abc $ABC 123")
+                .param("field4", "ten")
+                .param("field5", "01101AA")
+                .param("field6", "90201 1111AA")
+                .param("field7", "301-604-4882$$")
+                .param("error", "0"))
+                .andDo(MockMvcResultHandlers.print())
+                .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(true)));
+    }
+
+    @Test
+    public void notBypassingAllFieldShouldNotPass() throws Exception {
+        mockMvc.perform(MockMvcRequestBuilders.post("/BypassRestrictions/frontendValidation")
+                .param("field1", "abc")
+                .param("field2", "1234")
+                .param("field3", "abc $ABC 123")
+                .param("field4", "ten")
+                .param("field5", "01101AA")
+                .param("field6", "90201 1111AA")
+                .param("field7", "301-604-4882AA")
+                .param("error", "0"))
+                .andDo(MockMvcResultHandlers.print())
+                .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false)));
+    }
+
+
+}