diff --git a/config/dependency-check/project-suppression.xml b/config/dependency-check/project-suppression.xml
index a2a8e8470..7df811240 100644
--- a/config/dependency-check/project-suppression.xml
+++ b/config/dependency-check/project-suppression.xml
@@ -1,42 +1,77 @@
-
+
- cpe:/a:pivotal_software:spring_framework
- CVE-2020-5398
+ 7
-
+
- cpe:/a:redhat:undertow
- CVE-2019-14888
-
-
+ 13f4f564024d2f85502c151942307c3ca851a4f7
+ CVE-2016-1000027
+
+
- cpe:/a:pivotal_software:spring_security
- CVE-2018-1258
-
-
+ ^pkg:maven/org\.springframework/spring\-core@.*$
+ CVE-2016-1000027
+
+
+
+ ^pkg:maven/org\.springframework/spring\-aop@.*$
+ CVE-2016-1000027
+
+
+
+ ^pkg:maven/org\.springframework\.boot/spring\-boot\-starter\-security@.*$
+ CVE-2022-22978
+
+
+
+ ^pkg:maven/rubygems/jruby\-openssl@.*$
cpe:/a:jruby:jruby
- CVE-2018-1000613
- CVE-2018-1000180
- CVE-2017-18640
- CVE-2011-4838
-
-
+ cpe:/a:openssl:openssl
+
+
+
+ ^pkg:maven/com\.thoughtworks\.xstream/xstream@.*$
cpe:/a:xstream_project:xstream
- CVE-2017-7957
- CVE-2016-3674
- CVE-2020-26217
- CVE-2020-26258
-
-
- cpe:/a:postgresql:postgresql
- CVE-2018-10936
-
+ CVE-2013-7285
+ CVE-2016-3674
+ CVE-2017-7957
+ CVE-2020-26217
+ CVE-2020-26258
+ CVE-2020-26259
+ CVE-2021-21341
+ CVE-2021-21342
+ CVE-2021-21343
+ CVE-2021-21344
+ CVE-2021-21345
+ CVE-2021-21346
+ CVE-2021-21347
+ CVE-2021-21348
+ CVE-2021-21349
+ CVE-2021-21350
+ CVE-2021-21351
+ CVE-2021-43859
+
+
+
+ ^pkg:maven/org\.springframework/spring\-.*@.*$
+ CVE-2016-1000027
+
diff --git a/pom.xml b/pom.xml
index a56818b80..d9e0f2e80 100644
--- a/pom.xml
+++ b/pom.xml
@@ -119,7 +119,7 @@
9090
- 2.5.2
+ 2.5.3
3.3.7
2.2
3.1.2
@@ -337,8 +337,8 @@
6.5.1
7
- true
- true
+ false
+ false
@@ -536,14 +536,7 @@
org.asciidoctor
asciidoctorj
-
- org.jruby
- jruby-complete
-
-
-
-
diff --git a/src/main/java/org/owasp/webgoat/lessons/sql_injection/advanced/SqlInjectionLesson6a.java b/src/main/java/org/owasp/webgoat/lessons/sql_injection/advanced/SqlInjectionLesson6a.java
index 943d44570..38a02f2b1 100644
--- a/src/main/java/org/owasp/webgoat/lessons/sql_injection/advanced/SqlInjectionLesson6a.java
+++ b/src/main/java/org/owasp/webgoat/lessons/sql_injection/advanced/SqlInjectionLesson6a.java
@@ -41,15 +41,15 @@ import java.sql.*;
public class SqlInjectionLesson6a extends AssignmentEndpoint {
private final LessonDataSource dataSource;
-
+ private static final String YOUR_QUERY_WAS = "
Your query was: ";
public SqlInjectionLesson6a(LessonDataSource dataSource) {
this.dataSource = dataSource;
}
@PostMapping("/SqlInjectionAdvanced/attack6a")
@ResponseBody
- public AttackResult completed(@RequestParam String userid_6a) {
- return injectableQuery(userid_6a);
+ public AttackResult completed(@RequestParam(value="userid_6a") String userId) {
+ return injectableQuery(userId);
// The answer: Smith' union select userid,user_name, password,cookie,cookie, cookie,userid from user_system_data --
}
@@ -66,7 +66,7 @@ public class SqlInjectionLesson6a extends AssignmentEndpoint {
ResultSet.CONCUR_READ_ONLY)) {
ResultSet results = statement.executeQuery(query);
- if ((results != null) && (results.first())) {
+ if ((results != null) && results.first()) {
ResultSetMetaData resultsMetaData = results.getMetaData();
StringBuilder output = new StringBuilder();
@@ -83,17 +83,16 @@ public class SqlInjectionLesson6a extends AssignmentEndpoint {
output.append(appendingWhenSucceded);
return success(this).feedback("sql-injection.advanced.6a.success").feedbackArgs(output.toString()).output(" Your query was: " + query).build();
} else {
- return failed(this).output(output.toString() + "
Your query was: " + query).build();
+ return failed(this).output(output.toString() + YOUR_QUERY_WAS + query).build();
}
} else {
- return failed(this).feedback("sql-injection.advanced.6a.no.results").output(" Your query was: " + query).build();
+ return failed(this).feedback("sql-injection.advanced.6a.no.results").output(YOUR_QUERY_WAS + query).build();
}
} catch (SQLException sqle) {
- return failed(this).output(sqle.getMessage() + "
Your query was: " + query).build();
+ return failed(this).output(sqle.getMessage() + YOUR_QUERY_WAS + query).build();
}
} catch (Exception e) {
- e.printStackTrace();
- return failed(this).output(this.getClass().getName() + " : " + e.getMessage() + "
Your query was: " + query).build();
+ return failed(this).output(this.getClass().getName() + " : " + e.getMessage() + YOUR_QUERY_WAS + query).build();
}
}
}
diff --git a/src/test/java/org/owasp/webgoat/lessons/sql_injection/introduction/SqlInjectionLesson6aTest.java b/src/test/java/org/owasp/webgoat/lessons/sql_injection/introduction/SqlInjectionLesson6aTest.java
index 34e13b2bb..d3c2653f1 100644
--- a/src/test/java/org/owasp/webgoat/lessons/sql_injection/introduction/SqlInjectionLesson6aTest.java
+++ b/src/test/java/org/owasp/webgoat/lessons/sql_injection/introduction/SqlInjectionLesson6aTest.java
@@ -23,9 +23,7 @@
package org.owasp.webgoat.lessons.sql_injection.introduction;
import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
import org.owasp.webgoat.lessons.sql_injection.SqlLessonTest;
-import org.springframework.test.context.junit.jupiter.SpringExtension;
import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
import static org.hamcrest.Matchers.containsString;