diff --git a/.gitignore b/.gitignore index 738bebaca..35def3a69 100644 --- a/.gitignore +++ b/.gitignore @@ -28,6 +28,7 @@ src/main/webapp/users/*.jar src/main/webapp/plugin_lessons/*.jar src/main/webapp/users/*.props classes/* +*.iml /*.iml .extract/* diff --git a/pom.xml b/pom.xml index 8b19911bb..8cbfd57a5 100644 --- a/pom.xml +++ b/pom.xml @@ -7,14 +7,6 @@ war 6.1.0 - - - maven2-repository.dev.java.net - Java.net Maven 2 Repository - http://download.java.net/maven/2 - - - 3.2.4.RELEASE @@ -252,8 +244,8 @@ javax.transaction - jta - 1.0.1B + javax.transaction-api + 1.2 net.sourceforge.jtds diff --git a/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java b/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java index 5b914f535..8c80c1d00 100644 --- a/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java +++ b/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java @@ -1,19 +1,5 @@ package org.owasp.webgoat.lessons; -import java.io.BufferedReader; -import java.io.FileNotFoundException; -import java.io.FileReader; -import java.io.InputStreamReader; -import java.io.StringReader; -import java.net.HttpURLConnection; -import java.net.URL; -import java.sql.ResultSet; -import java.sql.SQLException; -import java.sql.Statement; -import java.util.HashMap; -import java.util.LinkedList; -import java.util.List; -import java.util.Map; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; @@ -34,34 +20,50 @@ import org.owasp.webgoat.util.LabelManager; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import java.io.BufferedReader; +import java.io.File; +import java.io.FileNotFoundException; +import java.io.FileReader; +import java.io.InputStreamReader; +import java.io.StringReader; +import java.net.HttpURLConnection; +import java.net.URL; +import java.sql.ResultSet; +import java.sql.SQLException; +import java.sql.Statement; +import java.util.HashMap; +import java.util.LinkedList; +import java.util.List; +import java.util.Map; + /** * ************************************************************************************************* - * - * + *

+ *

* This file is part of WebGoat, an Open Web Application Security Project * utility. For details, please see http://www.owasp.org/ - * + *

* Copyright (c) 2002 - 20014 Bruce Mayhew - * + *

* This program is free software; you can redistribute it and/or modify it under * the terms of the GNU General Public License as published by the Free Software * Foundation; either version 2 of the License, or (at your option) any later * version. - * + *

* This program is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. - * + *

* You should have received a copy of the GNU General Public License along with * this program; if not, write to the Free Software Foundation, Inc., 59 Temple * Place - Suite 330, Boston, MA 02111-1307, USA. - * + *

* Getting Source ============== - * + *

* Source for this application is maintained at * https://github.com/WebGoat/WebGoat, a repository for free software projects. - * + *

* For details, please see http://webgoat.github.io * * @author Bruce Mayhew WebGoat @@ -161,8 +163,8 @@ public abstract class AbstractLesson extends Screen implements Comparable" + "Send this message to: " + s.getWebgoatContext().getFeedbackAddress() + ""); + + s.getCurrentLesson().getLessonName() + "\">" + s.getWebgoatContext() + .getFeedbackAddress() + ""); } Html html = new Html(); @@ -510,7 +510,8 @@ public abstract class AbstractLesson extends Screen implements Comparable" + "Send this message to: " + s.getWebgoatContext().getFeedbackAddress() + ""); + + s.getCurrentLesson().getLessonName() + "\">" + s.getWebgoatContext() + .getFeedbackAddress() + ""); } return src; @@ -528,7 +529,8 @@ public abstract class AbstractLesson extends Screen implements Comparable" + "Send this message to: " + s.getWebgoatContext().getFeedbackAddress() + ""); + + s.getCurrentLesson().getLessonName() + "\">" + s.getWebgoatContext() + .getFeedbackAddress() + ""); } // Solutions are html files @@ -538,12 +540,12 @@ public abstract class AbstractLesson extends Screen implements Comparable * Returns the default "path" portion of a lesson's URL.

- * + *

*

* Legacy webgoat lesson links are of the form * "attack?Screen=Xmenu=Ystage=Z". This method returns the path portion of * the url, i.e., "attack" in the string above.

- * + *

*

* Newer, Spring-Controller-based classes will override this method to * return "*.do"-styled paths.

@@ -622,7 +624,7 @@ public abstract class AbstractLesson extends Screen implements Comparable + * A reference in include directives are made from within the web application on the server. + * However, img tags (and the like) make references from the client browser. + * In such external references, the context path must be included. + */ protected final String buildImagePath(WebSession w, String imgResourceName) { - return w.getRequest().getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/images/" + imgResourceName; + return w.getRequest() + .getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/images/" + imgResourceName; } - protected final String buildJspPath(WebSession w, String jspResourceName) { - return w.getRequest().getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/jsp/" + jspResourceName; + + protected final String buildJspPath(WebSession w, String jspResourceName, boolean includeContextPath) { + String path = includeContextPath ? w.getContext().getContextPath() : ""; + return path + "/plugin_extracted/plugin/" + getLessonName() + "/jsp/" + jspResourceName; } protected final String buildJsPath(WebSession w, String jsResourceName) { - return w.getRequest().getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/js/" + jsResourceName; + return w.getRequest() + .getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/js/" + jsResourceName; + } + + protected final File getLessonDirectory(WebSession w) { + return new File(w.getContext().getRealPath("/plugin_extracted/plugin/" + getLessonName() + "/")); } } diff --git a/webgoat-classloader/pom.xml b/webgoat-classloader/pom.xml index ecf0205b0..ec9b798a0 100644 --- a/webgoat-classloader/pom.xml +++ b/webgoat-classloader/pom.xml @@ -7,6 +7,21 @@ jar 6.1.0 + + + + org.apache.maven.plugins + maven-compiler-plugin + 3.1 + + 1.7 + 1.7 + ISO-8859-1 + + + + + org.apache.tomcat @@ -15,4 +30,6 @@ + + \ No newline at end of file