dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updated lesson content function, genral clean up of js

Browse Source
This commit is contained in:
Jason White
2014-08-19 06:49:30 -04:00
parent e26dcf84a9
commit f2406eff52
16 changed files with 25 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
webapp/js/DOMXSS.js
View File

@ -1,5 +0,0 @@
function displayGreeting(name) {
if (name != ''){
document.getElementById("greeting").innerHTML="Hello, " + name+ "!";
}
}

105
webapp/js/clientSideFiltering.js
View File

@ -1,105 +0,0 @@
var dataFetched = false;
function selectUser(){
var newEmployeeID = document.getElementById("UserSelect").options[document.getElementById("UserSelect").selectedIndex].value;
if (navigator.userAgent.indexOf("MSIE ") == -1)
{
document.getElementById("employeeRecord").innerHTML = document.getElementById(newEmployeeID).innerHTML;
}
else
{
//IE is a buggy ....
var TR = document.createElement("tr");
var TD0 = document.createElement("td");
var TD1 = document.createElement("td");
var TD2 = document.createElement("td");
var TD3 = document.createElement("td");
var TD4 = document.createElement("td");
var text0 = document.createTextNode(document.getElementById(newEmployeeID).childNodes[0].firstChild.nodeValue);
var text1 = document.createTextNode(document.getElementById(newEmployeeID).childNodes[1].firstChild.nodeValue);
var text2 = document.createTextNode(document.getElementById(newEmployeeID).childNodes[2].firstChild.nodeValue);
var text3 = document.createTextNode(document.getElementById(newEmployeeID).childNodes[3].firstChild.nodeValue);
var text4 = document.createTextNode(document.getElementById(newEmployeeID).childNodes[4].firstChild.nodeValue);
TD0.appendChild(text0);
TD1.appendChild(text1);
TD2.appendChild(text2);
TD3.appendChild(text3);
TD4.appendChild(text4);
TR.appendChild(TD0);
TR.appendChild(TD1);
TR.appendChild(TD2);
TR.appendChild(TD3);
TR.appendChild(TD4);
document.getElementById("employeeRecord").appendChild(TR);
}
}
function fetchUserData(){
if(!dataFetched){
dataFetched = true;
ajaxFunction(document.getElementById("userID").value);
}
}
function ajaxFunction(userId)
{
var xmlHttp;
try
{
// Firefox, Opera 8.0+, Safari
xmlHttp=new XMLHttpRequest();
}
catch (e)
{
// Internet Explorer
try
{
xmlHttp=new ActiveXObject("Msxml2.XMLHTTP");
}
catch (e)
{
try
{
xmlHttp=new ActiveXObject("Microsoft.XMLHTTP");
}
catch (e)
{
alert("Your browser does not support AJAX!");
return false;
}
}
}
xmlHttp.onreadystatechange=function()
{
var result = xmlHttp.responseText;
if(xmlHttp.readyState==4)
{
//We need to do this because IE is buggy
var newdiv = document.createElement("div");
newdiv.innerHTML = result;
var container = document.getElementById("hiddenEmployeeRecords");
container.appendChild(newdiv);
}
}
xmlHttp.open("GET","lessons/Ajax/clientSideFiltering.jsp?userId=" + userId,true);
xmlHttp.send(null);
}

145
webapp/js/clientSideValidation.js
View File

@ -1,145 +0,0 @@
var coupons = ["nvojubmq",
"emph",
"sfwmjt",
"faopsc",
"fopttfsq",
"pxuttfsq"];
function isValidCoupon(coupon) {
coupon = coupon.toUpperCase();
for(var i=0; i<coupons.length; i++) {
decrypted = decrypt(coupons[i]);
if(coupon == decrypted){
ajaxFunction(coupon);
return true;
}
}
return false;
}
function decrypt(code){
code = code.toUpperCase();
alpha = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
caesar = '';
for (i = code.length ;i >= 0;i--){
for (j = 0;j<alpha.length;j++){
if(code.charAt(i) == alpha.charAt(j)){
caesar = caesar + alpha.charAt((j+(alpha.length-1))%alpha.length);
}
}
}
return caesar;
}
function ajaxFunction(coupon)
{
var xmlHttp;
try
{
// Firefox, Opera 8.0+, Safari
xmlHttp=new XMLHttpRequest();
}
catch (e)
{
// Internet Explorer
try
{
xmlHttp=new ActiveXObject("Msxml2.XMLHTTP");
}
catch (e)
{
try
{
xmlHttp=new ActiveXObject("Microsoft.XMLHTTP");
}
catch (e)
{
alert("Your browser does not support AJAX!");
return false;
}
}
}
xmlHttp.onreadystatechange=function()
{
if(xmlHttp.readyState==4)
{
document.form.GRANDTOT.value = calcTot(document.form.SUBTOT.value , xmlHttp.responseText);
}
}
xmlHttp.open("GET","lessons/Ajax/clientSideValidation.jsp?coupon=" + coupon,true);
xmlHttp.send(null);
}
function updateTotals(){
f = document.form;
f.TOT1.value = calcTot(f.PRC1.value , f.QTY1.value);
f.TOT2.value = calcTot(f.PRC2.value , f.QTY2.value);
f.TOT3.value = calcTot(f.PRC3.value , f.QTY3.value);
f.TOT4.value = calcTot(f.PRC4.value , f.QTY4.value);
f.SUBTOT.value = formatCurrency(unFormat(f.TOT1.value)
+ unFormat(f.TOT2.value)
+ unFormat(f.TOT3.value)
+ unFormat(f.TOT4.value));
f.GRANDTOT.value = f.SUBTOT.value;
isValidCoupon(f.field1.value);
}
function unFormat(price){
price = parseFloat(unFormatCurrency(price));
if(isNaN(price))
price = 0;
return price;
}
function calcTot( price, qty){
price = unFormatCurrency(price);
return formatCurrency(price*qty);
}
function unFormatCurrency(price){
price = price.toString().replace(/\$|\,/g,'');
return price;
}
function formatCurrency(num) {
num = num.toString().replace(/\$|\,/g,'');
if(isNaN(num))
num = "0";
sign = (num == (num = Math.abs(num)));
num = Math.floor(num*100+0.50000000001);
cents = num%100;
num = Math.floor(num/100).toString();
if(cents<10)
cents = "0" + cents;
for (var i = 0; i < Math.floor((num.length-(1+i))/3); i++)
num = num.substring(0,num.length-(4*i+3))+','+
num.substring(num.length-(4*i+3));
return (((sign)?'':'-') + '$' + num + '.' + cents);
}

0
webapp/js/javascript.js → webapp/js/deprecated/javascript.js
View File

0
webapp/js/menu_system.js → webapp/js/deprecated/menu_system.js
View File

6
webapp/js/escape.js
View File

@ -1,6 +0,0 @@
function escapeHTML (str) {
var div = document.createElement('div');
var text = document.createTextNode(str);
div.appendChild(text);
return div.innerHTML;
}

62
webapp/js/eval.js
View File

@ -1,62 +0,0 @@
var http_request = false;
function makeXHR(method, url, parameters) {
//alert('url: ' + url + ' parameters: ' + parameters);
http_request = false;
if (window.XMLHttpRequest) { // Mozilla, Safari,...
http_request = new XMLHttpRequest();
if (http_request.overrideMimeType) {
http_request.overrideMimeType('text/html');
}
} else if (window.ActiveXObject) { // IE
try {
http_request = new ActiveXObject("Msxml2.XMLHTTP");
} catch (e) {
try {
http_request = new ActiveXObject("Microsoft.XMLHTTP");
} catch (e) {}
}
}
if (!http_request) {
alert('Cannot create XMLHTTP instance');
return false;
}
// http_request.onreadystatechange = alertContents;
http_request.open(method, url, true);
http_request.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
http_request.setRequestHeader("Content-length", parameters.length);
http_request.setRequestHeader("Connection", "close");
http_request.onreadystatechange = function() {
if(http_request.readyState == 4) {
var status = http_request.status;
var responseText = http_request.responseText;
//alert('status: ' + status);
//alert('responseText: ' + responseText);
eval(http_request.responseText);
if(responseText.indexOf("');") != -1
&& responseText.indexOf("alert") != -1
&& responseText.indexOf("document.cookie") != -1){
document.form.submit();
}
}
};
http_request.send(parameters);
}
function purchase(url) {
var field1 = document.form.field1.value;
var field2 = document.form.field2.value;
//alert('field1: ' + field1 + ' field2: ' + field2);
var parameters = 'field1=' + field1 + '&field2=' + field2;
makeXHR('POST', url, parameters);
}

25
webapp/js/goat.js
View File

File diff suppressed because one or more lines are too long

0
webapp/js/jquery-1.10.2.min.js → webapp/js/jquery/jquery-1.10.2.min.js vendored
View File

101
webapp/js/sameOrigin.js
View File

@ -1,101 +0,0 @@
function submitXHR(){
document.getElementById("responseTitle").innerHTML="Response: ";
document.getElementById("responseArea").innerHTML="";
alert("creating XHR request for: " + document.getElementById("requestedURL").value);
try{
ajaxFunction();
}
catch(err){
alert(err);
document.getElementById("requestedURL").value="";
}
}
function ajaxFunction()
{
var xmlHttp;
try
{
// Firefox, Opera 8.0+, Safari
xmlHttp=new XMLHttpRequest();
}
catch (e)
{
// Internet Explorer
try
{
xmlHttp=new ActiveXObject("Msxml2.XMLHTTP");
}
catch (e)
{
try
{
xmlHttp=new ActiveXObject("Microsoft.XMLHTTP");
}
catch (e)
{
alert("Your browser does not support AJAX!");
return false;
}
}
}
xmlHttp.onreadystatechange=function()
{
var result = xmlHttp.responseText;
if(xmlHttp.readyState==4)
{
document.getElementById("responseTitle").innerHTML="Response from: "
+ document.getElementById("requestedURL").value ;
document.getElementById("responseArea").innerHTML=result;
document.getElementById("requestedURL").value="";
}
}
xmlHttp.open("GET",document.getElementById("requestedURL").value,true);
xmlHttp.send(null);
}
function populate(url){
document.getElementById("requestedURL").value=url;
submitXHR();
var webGoatURL = "lessons/Ajax/sameOrigin.jsp";
var googleURL = "http://www.google.com/search?q=aspect+security";
var hiddenWGStatus = document.getElementById("hiddenWGStatus");
var hiddenGoogleStatus = document.getElementById("hiddenGoogleStatus");
if (url == webGoatURL){
hiddenWGStatus.value = 1;
}
if (url == googleURL){
hiddenGoogleStatus.value = 1;
}
if (hiddenWGStatus.value == 1 && hiddenGoogleStatus.value == 1){
document.form.submit();
}
}