dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added comment parsing and feedback to text editor lessons

Browse Source
This commit is contained in:
Max Geldner
2018-11-19 17:48:49 +01:00
committed by Nanne Baars
parent b22deec5b8
commit f66ad51721
4 changed files with 42 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html
View File

@ -41,9 +41,9 @@
<div class="lesson-page-wrapper">
<div class="adoc-content" th:replace="doc:SqlInjection_jdbc_newcode.adoc"></div>
<div class="attack-container" style="height: 300px; border: none !important">
<div id="insertcode" class="attack-container" style="height: 300px; border: none !important">
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
<form class="attack-form" accept-charset="UNKNOWN" method="POST" name="form" action="/WebGoat/SqlInjection/attack10b" enctype="application/json;charset=UTF-8">
<form id="codesubmit" class="attack-form" accept-charset="UNKNOWN" method="POST" name="form" action="/WebGoat/SqlInjection/attack10b" enctype="application/json;charset=UTF-8">
<div>
<div id="editor" style="position: absolute; top: 0; right: 0; bottom: 0; left: 0;" name="editor"></div>
<script th:src="@{/js/libs/ace/src-noconflict/ace.js}" type="text/javascript" charset="utf-8"></script>
@ -55,9 +55,11 @@
</script>
</div>
<div class="input-group" style="margin-top: 10px">
<!--<input name="solution" value="Submit code" style="margin-top: 350%; margin-left: 60%;" type="SUBMIT" onclick="ace_collect()"/>-->
<button type="button" class="btn btn-primary" style="margin-top: 350%; margin-left: 60%;" onclick="ace_collect()">Submit</button>
</div>
</form>
<br />
<div class="attack-feedback"></div>
<div class="attack-output"></div>
</div>

4
webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties
View File

@ -66,6 +66,10 @@ SqlStringInjectionHint.9.5=How about something like '; UPDATE employees....
sql-injection.10.success=<span class='feedback-positive'>Success! You successfully deleted the access_log table and that way compromised the availability of the data.</span>
sql-injection.10.entries=<span class='feedback-negative'>There's still evidence of what you did. Better remove the whole table.</span>
sql-injection.10b.success=Your code can prevent an SQL Injection! Success!
sql-injection.10b.failed=Something doesn't seem right with that code. Maybe you should look at an example how to prevent SQL Injections with JDBC?
SqlStringInjectionHint.10.1=Use the techniques that you have learned before.
SqlStringInjectionHint.10.2=The application takes your input and filters for entries that are LIKE it.
SqlStringInjectionHint.10.3=Try query chaining to reach the goal.

15
webgoat-lessons/sql-injection/src/main/resources/js/assignment10b.js
View File

@ -1,16 +1,25 @@
function ace_collect() {
let code = "";
console.log("Test");
$(".ace_line").each(function(i, el) {
code += el.innerHTML;
var to_add = el.innerHTML;
if(/\/\/.*/.test(to_add)) {
to_add = to_add.replace(/\/\/.*/i, '');
}
code += to_add;
});
console.log(code);
code = $(".ace_content")[0].innerHTML;
$.ajax({
type: "POST",
url: "/WebGoat/SqlInjection/attack10b",
dataType: "text",
data: {
editor: code
},
success: function(data) {
console.log("entry");
let lesson_feedback = JSON.parse(data);
$("#insertcode .attack-feedback").css("display", "block");
$("#insertcode .attack-feedback").html(lesson_feedback.feedback);
}
});
}