From 21d450f32080748536b6b9b6d07b13c617ecaa6c Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Fri, 26 Jun 2015 11:00:18 +0200 Subject: [PATCH 1/4] Added a method so we can fetch the absolute path of a lesson --- .../owasp/webgoat/lessons/AbstractLesson.java | 34 +++++++++++-------- 1 file changed, 20 insertions(+), 14 deletions(-) diff --git a/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java b/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java index 5b914f535..bf435a261 100644 --- a/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java +++ b/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java @@ -1,19 +1,5 @@ package org.owasp.webgoat.lessons; -import java.io.BufferedReader; -import java.io.FileNotFoundException; -import java.io.FileReader; -import java.io.InputStreamReader; -import java.io.StringReader; -import java.net.HttpURLConnection; -import java.net.URL; -import java.sql.ResultSet; -import java.sql.SQLException; -import java.sql.Statement; -import java.util.HashMap; -import java.util.LinkedList; -import java.util.List; -import java.util.Map; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; @@ -34,6 +20,22 @@ import org.owasp.webgoat.util.LabelManager; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import java.io.BufferedReader; +import java.io.File; +import java.io.FileNotFoundException; +import java.io.FileReader; +import java.io.InputStreamReader; +import java.io.StringReader; +import java.net.HttpURLConnection; +import java.net.URL; +import java.sql.ResultSet; +import java.sql.SQLException; +import java.sql.Statement; +import java.util.HashMap; +import java.util.LinkedList; +import java.util.List; +import java.util.Map; + /** * ************************************************************************************************* * @@ -819,4 +821,8 @@ public abstract class AbstractLesson extends Screen implements Comparable Date: Fri, 26 Jun 2015 15:48:11 +0200 Subject: [PATCH 2/4] include choice between relative path and reference with context root included --- .../owasp/webgoat/lessons/AbstractLesson.java | 79 +++++++++++-------- 1 file changed, 45 insertions(+), 34 deletions(-) diff --git a/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java b/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java index bf435a261..8c80c1d00 100644 --- a/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java +++ b/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java @@ -38,32 +38,32 @@ import java.util.Map; /** * ************************************************************************************************* - * - * + *

+ *

* This file is part of WebGoat, an Open Web Application Security Project * utility. For details, please see http://www.owasp.org/ - * + *

* Copyright (c) 2002 - 20014 Bruce Mayhew - * + *

* This program is free software; you can redistribute it and/or modify it under * the terms of the GNU General Public License as published by the Free Software * Foundation; either version 2 of the License, or (at your option) any later * version. - * + *

* This program is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. - * + *

* You should have received a copy of the GNU General Public License along with * this program; if not, write to the Free Software Foundation, Inc., 59 Temple * Place - Suite 330, Boston, MA 02111-1307, USA. - * + *

* Getting Source ============== - * + *

* Source for this application is maintained at * https://github.com/WebGoat/WebGoat, a repository for free software projects. - * + *

* For details, please see http://webgoat.github.io * * @author Bruce Mayhew WebGoat @@ -163,8 +163,8 @@ public abstract class AbstractLesson extends Screen implements Comparable" + "Send this message to: " + s.getWebgoatContext().getFeedbackAddress() + ""); + + s.getCurrentLesson().getLessonName() + "\">" + s.getWebgoatContext() + .getFeedbackAddress() + ""); } Html html = new Html(); @@ -512,7 +510,8 @@ public abstract class AbstractLesson extends Screen implements Comparable" + "Send this message to: " + s.getWebgoatContext().getFeedbackAddress() + ""); + + s.getCurrentLesson().getLessonName() + "\">" + s.getWebgoatContext() + .getFeedbackAddress() + ""); } return src; @@ -530,7 +529,8 @@ public abstract class AbstractLesson extends Screen implements Comparable" + "Send this message to: " + s.getWebgoatContext().getFeedbackAddress() + ""); + + s.getCurrentLesson().getLessonName() + "\">" + s.getWebgoatContext() + .getFeedbackAddress() + ""); } // Solutions are html files @@ -540,12 +540,12 @@ public abstract class AbstractLesson extends Screen implements Comparable * Returns the default "path" portion of a lesson's URL.

- * + *

*

* Legacy webgoat lesson links are of the form * "attack?Screen=Xmenu=Ystage=Z". This method returns the path portion of * the url, i.e., "attack" in the string above.

- * + *

*

* Newer, Spring-Controller-based classes will override this method to * return "*.do"-styled paths.

@@ -624,7 +624,7 @@ public abstract class AbstractLesson extends Screen implements Comparable + * A reference in include directives are made from within the web application on the server. + * However, img tags (and the like) make references from the client browser. + * In such external references, the context path must be included. + */ protected final String buildImagePath(WebSession w, String imgResourceName) { - return w.getRequest().getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/images/" + imgResourceName; + return w.getRequest() + .getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/images/" + imgResourceName; } - protected final String buildJspPath(WebSession w, String jspResourceName) { - return w.getRequest().getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/jsp/" + jspResourceName; + + protected final String buildJspPath(WebSession w, String jspResourceName, boolean includeContextPath) { + String path = includeContextPath ? w.getContext().getContextPath() : ""; + return path + "/plugin_extracted/plugin/" + getLessonName() + "/jsp/" + jspResourceName; } protected final String buildJsPath(WebSession w, String jsResourceName) { - return w.getRequest().getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/js/" + jsResourceName; + return w.getRequest() + .getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/js/" + jsResourceName; } protected final File getLessonDirectory(WebSession w) { From efc047b030733c2daebb34d6007c5fa8d81ab8a0 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Wed, 1 Jul 2015 22:36:34 +0200 Subject: [PATCH 3/4] Added compiler version to pom.xml --- webgoat-classloader/pom.xml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/webgoat-classloader/pom.xml b/webgoat-classloader/pom.xml index ecf0205b0..ec9b798a0 100644 --- a/webgoat-classloader/pom.xml +++ b/webgoat-classloader/pom.xml @@ -7,6 +7,21 @@ jar 6.1.0 + + + + org.apache.maven.plugins + maven-compiler-plugin + 3.1 + + 1.7 + 1.7 + ISO-8859-1 + + + + + org.apache.tomcat @@ -15,4 +30,6 @@ + + \ No newline at end of file From 1f14aa7c9b3a29df137a1156e3c9db17bfbbdef8 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Sun, 12 Jul 2015 12:16:59 +0200 Subject: [PATCH 4/4] WEB-214: Fixed build failure while downloading javax.transaction dependency Conflicts: .gitignore --- .gitignore | 1 + pom.xml | 12 ++---------- 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/.gitignore b/.gitignore index 738bebaca..35def3a69 100644 --- a/.gitignore +++ b/.gitignore @@ -28,6 +28,7 @@ src/main/webapp/users/*.jar src/main/webapp/plugin_lessons/*.jar src/main/webapp/users/*.props classes/* +*.iml /*.iml .extract/* diff --git a/pom.xml b/pom.xml index 8b19911bb..8cbfd57a5 100644 --- a/pom.xml +++ b/pom.xml @@ -7,14 +7,6 @@ war 6.1.0 - - - maven2-repository.dev.java.net - Java.net Maven 2 Repository - http://download.java.net/maven/2 - - - 3.2.4.RELEASE @@ -252,8 +244,8 @@ javax.transaction - jta - 1.0.1B + javax.transaction-api + 1.2 net.sourceforge.jtds