dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
WebGoat/main/project/JavaSource/org/owasp/webgoat/lessons/ConcurrencyCart.java
rogan.dawes b0b94c4688 Miscellaneous bug fixes 
divide by zero, inaccurate discount and totals, reflection of user input


git-svn-id: http://webgoat.googlecode.com/svn/trunk/webgoat@273 4033779f-a91e-0410-96ef-6bf7bf53c507
2008-01-14 14:02:11 +00:00

610 lines
21 KiB
Java
Raw Blame History

package org.owasp.webgoat.lessons;
import java.text.NumberFormat;
import java.util.ArrayList;
import java.util.List;
import java.util.Locale;
import java.util.regex.Pattern;
import org.apache.ecs.Element;
import org.apache.ecs.ElementContainer;
import org.apache.ecs.html.A;
import org.apache.ecs.html.BR;
import org.apache.ecs.html.Center;
import org.apache.ecs.html.H1;
import org.apache.ecs.html.HR;
import org.apache.ecs.html.IMG;
import org.apache.ecs.html.Input;
import org.apache.ecs.html.TD;
import org.apache.ecs.html.TH;
import org.apache.ecs.html.TR;
import org.apache.ecs.html.Table;
import org.owasp.webgoat.session.ECSFactory;
import org.owasp.webgoat.session.ParameterNotFoundException;
import org.owasp.webgoat.session.WebSession;
import org.owasp.webgoat.util.HtmlEncoder;
/*******************************************************************************
*
*
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
*
* Copyright (c) 2002 - 2007 Bruce Mayhew
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
*
* Getting Source ==============
*
* Source for this application is maintained at code.google.com, a repository
* for free software projects.
*
* For details, please see http://code.google.com/p/webgoat/
*
* @author Ryan Knell <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @created July, 23 2007
*/
public class ConcurrencyCart extends LessonAdapter
{
//Shared Variables
private static int total = 0;
private static float runningTOTAL = 0;
private static int subTOTAL = 0;
private static float calcTOTAL = 0;
private static int quantity1 = 0;
private static int quantity2 = 0;
private static int quantity3 = 0;
private static int quantity4 = 0;
private float ratio = 0;
private int discount = 0;
public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0));
/**
* Description of the Method
*
* @param s Description of the Parameter
* @return Description of the Return Value
*/
protected Element createContent(WebSession s)
{
ElementContainer ec = null;
try
{
String submit = s.getParser().getStringParameter("SUBMIT");
if("Purchase".equalsIgnoreCase(submit))
{
updateQuantity(s);
ec = createPurchaseContent(s, quantity1, quantity2, quantity3, quantity4);
}
else if ("Confirm".equalsIgnoreCase(submit))
{
ec = confirmation(s, quantity1, quantity2, quantity3, quantity4);
//Discount
if (calcTOTAL == 0) // No total cost for items
{
discount = 0; // Discount meaningless
}
else // The expected case -- items cost something
{
ratio = runningTOTAL / calcTOTAL;
}
if (calcTOTAL > runningTOTAL)
{
//CONGRATS
discount = (int) (100 * (1 - ratio));
s.setMessage("Thank you for shopping! You have (illegally!) received a " + discount +"% discount. Police are on the way to your IP address.");
makeSuccess(s);
}
else if (calcTOTAL < runningTOTAL)
{
//ALMOST
discount = (int) (100 * (ratio - 1));
s.setMessage("You are on the right track, but you actually overpaid by " + discount + "%. Try again!");
}
}
else
{
updateQuantity(s);
ec = createShoppingPage(s, quantity1, quantity2, quantity3, quantity4);
}
}
catch (ParameterNotFoundException pnfe)
{
System.out.println("[DEBUG] no action selected, defaulting to createShoppingPage");
ec = createShoppingPage(s, quantity1, quantity2, quantity3, quantity4);
}
return ec;
}
//UPDATE QUANTITY VARIABLES
private void updateQuantity(WebSession s)
{
quantity1 = thinkPositive(s.getParser().getIntParameter("QTY1", 0));
quantity2 = thinkPositive(s.getParser().getIntParameter("QTY2", 0));
quantity3 = thinkPositive(s.getParser().getIntParameter("QTY3", 0));
quantity4 = thinkPositive(s.getParser().getIntParameter("QTY4", 0));
}
/*
**********************************************************************
******************* PURCHASING PAGE **********************************
**********************************************************************
*/
private ElementContainer createPurchaseContent(WebSession s, int quantity1, int quantity2, int quantity3, int quantity4)
{
ElementContainer ec = new ElementContainer();
runningTOTAL = 0;
String regex1 = "^[0-9]{3}$";// any three digits
Pattern pattern1 = Pattern.compile(regex1);
try
{
String param1 = s.getParser().getRawParameter("PAC", "111");
String param2 = HtmlEncoder.encode(s.getParser().getRawParameter(
"CC", "5321 1337 8888 2007"));
// test input field1
if (!pattern1.matcher(param1).matches())
{
s.setMessage("Error! You entered " + HtmlEncoder.encode(param1) + " instead of your 3 digit code. Please try again.");
}
ec.addElement(new HR().setWidth("90%"));
ec.addElement(new Center().addElement(new H1().addElement("Place your order ")));
Table table = new Table().setCellSpacing(0).setCellPadding(2)
.setBorder(1).setWidth("90%").setAlign("center");
if (s.isColor())
{ table.setBorder(1); }
//Table Setup
TR tr = new TR();
tr.addElement(new TH().addElement("Shopping Cart Items").setWidth("80%"));
tr.addElement(new TH().addElement("Price").setWidth("10%"));
tr.addElement(new TH().addElement("Quantity").setWidth("3%"));
tr.addElement(new TH().addElement("Subtotal").setWidth("7%"));
table.addElement(tr);
//Item 1
tr = new TR(); //Create a new table object
tr.addElement(new TD().addElement("Hitachi - 750GB External Hard Drive"));
tr.addElement(new TD().addElement("$169.00").setAlign("right"));
tr.addElement(new TD().addElement(String.valueOf(quantity1)).setAlign("center"));
total = quantity1 * 169;
runningTOTAL += total;
tr.addElement(new TD().addElement("$" + formatInt(total) +".00"));
table.addElement(tr); //Adds table to the HTML
//Item 2
tr = new TR();
tr.addElement(new TD().addElement("Hewlett-Packard - All-in-One Laser Printer"));
tr.addElement(new TD().addElement("$299.00").setAlign("right"));
tr.addElement(new TD().addElement(String.valueOf(quantity2)).setAlign("center"));
total = quantity2 * 299;
runningTOTAL += total;
tr.addElement(new TD().addElement("$" + formatInt(total) +".00"));
table.addElement(tr);
//Item 3
tr = new TR();
tr.addElement(new TD().addElement("Sony - Vaio with Intel Centrino"));
tr.addElement(new TD().addElement("$1799.00").setAlign("right"));
tr.addElement(new TD().addElement(String.valueOf(quantity3)).setAlign("center"));
total = quantity3 * 1799;
runningTOTAL += total;
tr.addElement(new TD().addElement("$" + formatInt(total) +".00"));
table.addElement(tr);
//Item 4
tr = new TR();
tr.addElement(new TD().addElement("Toshiba - XGA LCD Projector "));
tr.addElement(new TD().addElement("$649.00").setAlign("right"));
tr.addElement(new TD().addElement(String.valueOf(quantity4)).setAlign("center"));
total = quantity4 * 649;
runningTOTAL += total;
tr.addElement(new TD().addElement("$" + formatInt(total) +".00"));
table.addElement(tr);
ec.addElement(table);
table = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0)
.setWidth("90%").setAlign("center");
if (s.isColor()) { table.setBorder(1); }
ec.addElement(new BR());
calcTOTAL = runningTOTAL;
//Total Charged
tr = new TR();
tr.addElement(new TD().addElement("Total:"));
tr.addElement(new TD().addElement("$" + formatFloat(runningTOTAL)).setAlign("right"));
table.addElement(tr);
tr = new TR();
tr.addElement(new TD().addElement("&nbsp;").setColSpan(2));
table.addElement(tr);
//Credit Card Input
tr = new TR();
tr.addElement(new TD().addElement("Enter your credit card number:"));
tr.addElement(new TD().addElement(new Input(Input.TEXT, "CC", param2)).setAlign("right"));
table.addElement(tr);
//PAC Input
tr = new TR();
tr.addElement(new TD().addElement("Enter your three digit access code:"));
tr.addElement(new TD().addElement(new Input(Input.TEXT, "PAC", param1)).setAlign("right"));
table.addElement(tr);
//Confirm Button
Element b = ECSFactory.makeButton("Confirm");
tr = new TR();
tr.addElement(new TD().addElement(b).setColSpan(2).setAlign("right"));
table.addElement(tr);
//Cancel Button
Element c = ECSFactory.makeButton("Cancel");
tr = new TR();
tr.addElement(new TD().addElement(c).setColSpan(2).setAlign("right"));
table.addElement(tr);
ec.addElement(table);
ec.addElement(new BR());
}
catch (Exception e)
{
s.setMessage("Error generating " + this.getClass().getName());
e.printStackTrace();
}
return (ec);
}
/*
**********************************************************************
******************* CONFIRMATION PAGE ********************************
**********************************************************************
*/
private ElementContainer confirmation (WebSession s, int quantity1, int quantity2, int quantity3, int quantity4)
{
ElementContainer ec = new ElementContainer();
final String confNumber = "CONC-88";
calcTOTAL = 0;
try
{
//Thread.sleep(5000);
ec.addElement(new HR().setWidth("90%"));
ec.addElement(new Center().addElement(new H1().addElement("Thank you for your purchase!")));
ec.addElement(new Center().addElement(new H1().addElement("Confirmation number: " + confNumber)));
Table table = new Table().setCellSpacing(0).setCellPadding(2)
.setBorder(1).setWidth("90%").setAlign("center");
if (s.isColor())
{ table.setBorder(1); }
//Table Setup
TR tr = new TR();
tr.addElement(new TH().addElement("Shopping Cart Items").setWidth("80%"));
tr.addElement(new TH().addElement("Price").setWidth("10%"));
tr.addElement(new TH().addElement("Quantity").setWidth("3%"));
tr.addElement(new TH().addElement("Subtotal").setWidth("7%"));
table.addElement(tr);
//Item 1
tr = new TR(); //Create a new table object
tr.addElement(new TD().addElement("Hitachi - 750GB External Hard Drive"));
tr.addElement(new TD().addElement("$169.00").setAlign("right"));
tr.addElement(new TD().addElement(String.valueOf(quantity1)).setAlign("center"));
total = quantity1 * 169;
calcTOTAL += total;
tr.addElement(new TD().addElement("$" + formatInt(total) +".00"));
table.addElement(tr); //Adds table to the HTML
//Item 2
tr = new TR();
tr.addElement(new TD().addElement("Hewlett-Packard - All-in-One Laser Printer"));
tr.addElement(new TD().addElement("$299.00").setAlign("right"));
tr.addElement(new TD().addElement(String.valueOf(quantity2)).setAlign("center"));
total = quantity2 * 299;
calcTOTAL += total;
tr.addElement(new TD().addElement("$" + formatInt(total) +".00"));
table.addElement(tr);
//Item 3
tr = new TR();
tr.addElement(new TD().addElement("Sony - Vaio with Intel Centrino"));
tr.addElement(new TD().addElement("$1799.00").setAlign("right"));
tr.addElement(new TD().addElement(String.valueOf(quantity3)).setAlign("center"));
total = quantity3 * 1799;
calcTOTAL += total;
tr.addElement(new TD().addElement("$" + formatInt(total) +".00"));
table.addElement(tr);
//Item 4
tr = new TR();
tr.addElement(new TD().addElement("Toshiba - XGA LCD Projector "));
tr.addElement(new TD().addElement("$649.00").setAlign("right"));
tr.addElement(new TD().addElement(String.valueOf(quantity4)).setAlign("center"));
total = quantity4 * 649;
calcTOTAL += total;
tr.addElement(new TD().addElement("$" + formatInt(total) +".00"));
table.addElement(tr);
ec.addElement(table);
table = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0)
.setWidth("90%").setAlign("center");
if (s.isColor())
{ table.setBorder(1); }
ec.addElement(new BR());
//Total Charged
tr = new TR();
tr.addElement(new TD().addElement("Total Amount Charged to Your Credit Card:"));
tr.addElement(new TD().addElement("$" + formatFloat(runningTOTAL)).setAlign("right"));
table.addElement(tr);
tr = new TR();
tr.addElement(new TD().addElement("&nbsp;").setColSpan(2));
table.addElement(tr);
//Return to Store Button
Element b = ECSFactory.makeButton("Return to Store");
tr = new TR();
tr.addElement(new TD().addElement(b).setColSpan(2).setAlign("center"));
table.addElement(tr);
ec.addElement(table);
ec.addElement(new BR());
}
catch (Exception e)
{
s.setMessage("Error generating " + this.getClass().getName());
e.printStackTrace();
}
return (ec);
}
/*
**********************************************************************
******************* SHOPPING PAGE **********************************
**********************************************************************
*/
private ElementContainer createShoppingPage(WebSession s, int quantity1, int quantity2, int quantity3, int quantity4)
{
ElementContainer ec = new ElementContainer();
subTOTAL = 0;
try
{
ec.addElement(new HR().setWidth("90%"));
ec.addElement(new Center().addElement(new H1().addElement("Shopping Cart ")));
Table table = new Table().setCellSpacing(0).setCellPadding(2)
.setBorder(1).setWidth("90%").setAlign("center");
if (s.isColor())
{ table.setBorder(1); }
//Table Setup
TR tr = new TR();
tr.addElement(new TH().addElement("Shopping Cart Items").setWidth("80%"));
tr.addElement(new TH().addElement("Price").setWidth("10%"));
tr.addElement(new TH().addElement("Quantity").setWidth("3%"));
tr.addElement(new TH().addElement("Subtotal").setWidth("7%"));
table.addElement(tr);
//Item 1
tr = new TR(); //Create a new table object
tr.addElement(new TD().addElement("Hitachi - 750GB External Hard Drive"));
tr.addElement(new TD().addElement("$169.00").setAlign("right"));
tr.addElement(new TD().addElement(
new Input(Input.TEXT, "QTY1", String.valueOf(quantity1)))
.setAlign("right"));
total = quantity1 * 169;
subTOTAL += total;
tr.addElement(new TD().addElement("$" + formatInt(total) +".00"));
table.addElement(tr); //Adds table to the HTML
//Item 2
tr = new TR();
tr.addElement(new TD().addElement("Hewlett-Packard - All-in-One Laser Printer"));
tr.addElement(new TD().addElement("$299.00").setAlign("right"));
tr.addElement(new TD().addElement(
new Input(Input.TEXT, "QTY2", String.valueOf(quantity2)))
.setAlign("right"));
total = quantity2 * 299;
subTOTAL += total;
tr.addElement(new TD().addElement("$" + formatInt(total) +".00"));
table.addElement(tr);
//Item 3
tr = new TR();
tr.addElement(new TD().addElement("Sony - Vaio with Intel Centrino"));
tr.addElement(new TD().addElement("$1799.00").setAlign("right"));
tr.addElement(new TD().addElement(
new Input(Input.TEXT, "QTY3", String.valueOf(quantity3)))
.setAlign("right"));
total = quantity3 * 1799;
subTOTAL += total;
tr.addElement(new TD().addElement("$" + formatInt(total) +".00"));
table.addElement(tr);
//Item 4
tr = new TR();
tr.addElement(new TD().addElement("Toshiba - XGA LCD Projector "));
tr.addElement(new TD().addElement("$649.00").setAlign("right"));
tr.addElement(new TD().addElement(
new Input(Input.TEXT, "QTY4", String.valueOf(quantity4)))
.setAlign("right"));
total = quantity4 * 649;
subTOTAL += total;
tr.addElement(new TD().addElement("$" + formatInt(total) +".00"));
table.addElement(tr);
ec.addElement(table);
table = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0)
.setWidth("90%").setAlign("center");
if (s.isColor())
{ table.setBorder(1); }
ec.addElement(new BR());
//Purchasing Amount
tr = new TR();
tr.addElement(new TD().addElement("Total: " +"$" +formatInt(subTOTAL) +".00").setAlign("left"));
table.addElement(tr);
//Update Button
Element b = ECSFactory.makeButton("Update Cart");
tr = new TR();
tr.addElement(new TD().addElement(b).setColSpan(2).setAlign("right"));
table.addElement(tr);
tr = new TR();
tr.addElement(new TD().addElement("&nbsp;").setColSpan(2));
table.addElement(tr);
//Purchase Button
Element c = ECSFactory.makeButton("Purchase");
tr = new TR();
tr.addElement(new TD().addElement(c).setColSpan(2).setAlign("right"));
table.addElement(tr);
ec.addElement(table);
ec.addElement(new BR());
}
catch (Exception e)
{
s.setMessage("Error generating " + this.getClass().getName());
e.printStackTrace();
}
return (ec);
}
String formatInt (int i)
{
NumberFormat intFormat =
NumberFormat.getIntegerInstance(Locale.US);
return intFormat.format(i);
}
String formatFloat (float f)
{
NumberFormat floatFormat =
NumberFormat.getNumberInstance(Locale.US);
floatFormat.setMinimumFractionDigits(2);
floatFormat.setMaximumFractionDigits(2);
return floatFormat.format(f);
}
int thinkPositive(int i)
{
if (i < 0 )
return 0 ;
else
return i ;
}
/**
* DOCUMENT ME!
*
* @return DOCUMENT ME!
*/
protected Category getDefaultCategory() { return Category.CONCURRENCY; }
/**
* Gets the hints attribute of the AccessControlScreen object
*
* @return The hints value
*/
protected List<String> getHints(WebSession s)
{
List<String> hints = new ArrayList<String>();
hints.add("Can you purchase the merchandise in your shopping cart for a lower price?");
hints.add("Try using a new browser window to get a lower price.");
hints.add("In window A, purchase a low cost item, in window B a high cost item.");
hints.add("In window A, commit after updating cart in window B.");
return hints;
}
/**
* Gets the instructions attribute of the WeakAccessControl object
*
* @return The instructions value
*/
public String getInstructions(WebSession s)
{
String instructions = "For this exercise, your mission is to exploit the concurrency issue which will allow you to purchase merchandise for a lower price.";
return (instructions);
}
private final static Integer DEFAULT_RANKING = new Integer(120);
protected Integer getDefaultRanking() { return DEFAULT_RANKING; }
/**
* Gets the title attribute of the AccessControlScreen object
*
* @return The title value
*/
public String getTitle() { return "Shopping Cart Concurrency Flaw"; }
public Element getCredits() { return super.getCustomCredits("", ASPECT_LOGO); }
}
Reference in New Issue View Git Blame Copy Permalink