18d43f16d3
* working version with fixed link and GET for tracing purposes * added integration test * filter on request log
54 lines
1.8 KiB
Java
54 lines
1.8 KiB
Java
package org.owasp.webgoat;
|
|
|
|
import org.junit.Test;
|
|
|
|
import io.restassured.RestAssured;
|
|
import io.restassured.http.ContentType;
|
|
|
|
import java.util.HashMap;
|
|
import java.util.Map;
|
|
|
|
public class SqlInjectionMitigationTest extends IntegrationTest {
|
|
|
|
@Test
|
|
public void runTests() {
|
|
startLesson("SqlInjectionMitigations");
|
|
|
|
Map<String, Object> params = new HashMap<>();
|
|
params.clear();
|
|
params.put("field1", "getConnection");
|
|
params.put("field2", "PreparedStatement prep");
|
|
params.put("field3", "prepareStatement");
|
|
params.put("field4", "?");
|
|
params.put("field5", "?");
|
|
params.put("field6", "prep.setString(1,\"\")");
|
|
params.put("field7", "prep.setString(2,\\\"\\\")");
|
|
checkAssignment(url("/WebGoat/SqlInjectionMitigations/attack10a"), params, true);
|
|
|
|
params.put("editor", "try {\r\n" +
|
|
" Connection conn = DriverManager.getConnection(DBURL,DBUSER,DBPW);\r\n" +
|
|
" PreparedStatement prep = conn.prepareStatement(\"select id from users where name = ?\");\r\n" +
|
|
" prep.setString(1,\"me\");\r\n" +
|
|
" prep.execute();\r\n" +
|
|
" System.out.println(conn); //should output 'null'\r\n" +
|
|
"} catch (Exception e) {\r\n" +
|
|
" System.out.println(\"Oops. Something went wrong!\");\r\n" +
|
|
"}");
|
|
checkAssignment(url("/WebGoat/SqlInjectionMitigations/attack10b"), params, true);
|
|
|
|
RestAssured.given()
|
|
.when().relaxedHTTPSValidation().cookie("JSESSIONID", getWebGoatCookie())
|
|
.contentType(ContentType.JSON)
|
|
.get(url("/WebGoat/SqlInjectionMitigations/servers?column=(case when (true) then hostname else id end)"))
|
|
.then()
|
|
.statusCode(200);
|
|
|
|
params.clear();
|
|
params.put("ip", "104.130.219.202");
|
|
checkAssignment(url("/WebGoat/SqlInjectionMitigations/attack12a"), params, true);
|
|
|
|
checkResults("/SqlInjectionMitigations/");
|
|
|
|
}
|
|
}
|