WebGoat/main/project/JavaSource/org/owasp/webgoat/lessons/SoapRequest.java

/*
 * Created on May 26, 2005 TODO To change the template for this generated file go to Window -
 * Preferences - Java - Code Style - Code Templates
 */

package org.owasp.webgoat.lessons;

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.ArrayList;
import java.util.List;
import org.apache.ecs.Element;
import org.apache.ecs.ElementContainer;
import org.apache.ecs.html.A;
import org.apache.ecs.html.BR;
import org.apache.ecs.html.Input;
import org.apache.ecs.html.P;
import org.apache.ecs.html.TD;
import org.apache.ecs.html.TR;
import org.apache.ecs.html.Table;
import org.owasp.webgoat.session.DatabaseUtilities;
import org.owasp.webgoat.session.ECSFactory;
import org.owasp.webgoat.session.ParameterNotFoundException;
import org.owasp.webgoat.session.WebSession;
import org.owasp.webgoat.session.WebgoatContext;


/***************************************************************************************************
 * 
 * 
 * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
 * please see http://www.owasp.org/
 * 
 * Copyright (c) 2002 - 2007 Bruce Mayhew
 * 
 * This program is free software; you can redistribute it and/or modify it under the terms of the
 * GNU General Public License as published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 * 
 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
 * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License along with this program; if
 * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
 * 02111-1307, USA.
 * 
 * Getting Source ==============
 * 
 * Source for this application is maintained at code.google.com, a repository for free software
 * projects.
 * 
 * For details, please see http://code.google.com/p/webgoat/
 * 
 * @author asmolen
 * 
 *         TODO To change the template for this generated type comment go to Window - Preferences -
 *         Java - Code Style - Code Templates
 */
public class SoapRequest extends SequentialLessonAdapter
{

	public final static String firstName = "getFirstName";

	public final static String lastName = "getLastName";

	public final static String loginCount = "getLoginCount";

	public final static String ccNumber = "getCreditCard";

	// int instead of boolean to keep track of method invocation count
	static int accessFirstName;

	static int accessLastName;

	static int accessCreditCard;

	static int accessLoginCount;

	private static WebgoatContext webgoatContext;

	/**
	 * We maintain a static reference to WebgoatContext, since this class is also automatically
	 * instantiated by the Axis web services module, which does not call setWebgoatContext()
	 * (non-Javadoc)
	 * 
	 * @see org.owasp.webgoat.lessons.AbstractLesson#setWebgoatContext(org.owasp.webgoat.session.WebgoatContext)
	 */
	@Override
	public void setWebgoatContext(WebgoatContext webgoatContext)
	{
		SoapRequest.webgoatContext = webgoatContext;
	}

	@Override
	public WebgoatContext getWebgoatContext()
	{
		return SoapRequest.webgoatContext;
	}

	protected Category getDefaultCategory()
	{
		return Category.WEB_SERVICES;
	}

	protected List<String> getHints(WebSession s)
	{
		List<String> hints = new ArrayList<String>();
		hints
				.add("Accessible operations are delimited by the &lt;operation&gt; tag contained within the &lt;portType&gt; section of the WSDL. <BR> Below is an example of a typical operation (getFirstName): <br><br>"
						+ "&lt;wsdl:portType name=\"SoapRequest\"&gt; <br>"
						+ "&lt;wsdl:<strong>operation name=\"getFirstName\"</strong>&gt;<br>"
						+ "&lt;wsdl:input message=\"impl:getFirstNameRequest\" name=\"getFirstNameRequest\" /&gt;<br>"
						+ "&lt;wsdl:output message=\"impl:getFirstNameResponse\" name=\"getFirstNameResponse\" /&gt;<br>"
						+ "&lt;wsdlsoap:operation soapAction=\"\" /&gt;"
						+ "&lt;/wsdl:portType&gt;<br><br>"
						+ "The methods invoked are defined by the input and output message attributes. "
						+ "Example: <strong>\"getFirstNameRequest\"</strong>");
		hints
				.add("There are several tags within a SOAP envelope. "
						+ "Each namespace is defined in the &lt;definitions&gt; section of the WSDL, and is declared using the (xmlns:namespace_name_here=\"namespace_reference_location_here\") format.<br><br>"
						+ "The following example defines a tag \"&lt;xsd:\", whose attribute structure will reference the namespace location assigned to it in the declaration:<br>"
						+ "<strong>xmlns:xsd=\"http://www.w3.org/2001/XMLSchema</strong>");
		hints
				.add("Determine what parameters and types are required by the message definition corresponding to the operation's request method. "
						+ "This example defines a parameter (id) of type (int) in the namespace (xsd) for the method (getFirstNameRequest):<br>"
						+ "&lt;wsdl:message name=\"getFirstNameRequest\"<br><br>"
						+ "&lt;wsdl:<strong>part name=\"id\" type=\"xsd:int\"</strong> /&gt;<br>"
						+ "&lt;/wsdl:message&gt;<br><br>"
						+ "Examples of other types:<br>"
						+ "{boolean, byte, base64Binary, double, float, int, long, short, unsignedInt, unsignedLong, unsignedShort, string}.<br>");
		String soapEnv = "A SOAP request uses the following HTTP header: <br><br> "
				+ "SOAPAction: some action header, can be &quot;&quot; <br><br>"
				+ "The SOAP message body has the following format:<br>"
				+ "&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?&gt; <br>"
				+ "&lt;SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" <br>"
				+ "	                  xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" <br>"
				+ "	                  xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"&gt; <br>"
				+ "&nbsp;&nbsp;&lt;SOAP-ENV:Body&gt; <br>"
				+ "&nbsp;&nbsp;&nbsp;&nbsp;&lt;ns1:getFirstName SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\" xmlns:ns1=\"http://lessons\"&gt; <br>"
				+ "&nbsp;&nbsp;&nbsp;&nbsp;&lt;id xsi:type=\"xsd:int\"&gt;101&lt;/id&gt; <br>"
				+ "&nbsp;&nbsp;&nbsp;&nbsp;&lt;/ns1:getFirstName&gt; <br>" + "&nbsp;&nbsp;&lt;/SOAP-ENV:Body&gt; <br>"
				+ "&lt;/SOAP-ENV:Envelope&gt; <br><br>"
				+ "Intercept the HTTP request and try to create a SOAP request.";
		soapEnv.replaceAll("(?s) ", "&nbsp;");
		hints.add(soapEnv);

		return hints;
	}

	private final static Integer DEFAULT_RANKING = new Integer(100);

	protected Integer getDefaultRanking()
	{
		return DEFAULT_RANKING;
	}

	public String getTitle()
	{
		return "Create a SOAP Request";
	}

	protected Element makeOperationsLine(WebSession s)
	{
		ElementContainer ec = new ElementContainer();

		Table t1 = new Table().setCellSpacing(0).setCellPadding(2);

		if (s.isColor())
		{
			t1.setBorder(1);
		}

		TR tr = new TR();
		tr.addElement(new TD().addElement("How many operations are defined in the WSDL: "));
		tr.addElement(new TD(new Input(Input.TEXT, "count", "")));
		Element b = ECSFactory.makeButton("Submit");
		tr.addElement(new TD(b).setAlign("LEFT"));
		t1.addElement(tr);

		ec.addElement(t1);

		return ec;
	}

	protected Element makeTypeLine(WebSession s)
	{
		ElementContainer ec = new ElementContainer();

		Table t1 = new Table().setCellSpacing(0).setCellPadding(2);

		if (s.isColor())
		{
			t1.setBorder(1);
		}

		TR tr = new TR();
		tr.addElement(new TD()
				.addElement("Now, what is the type of the (id) parameter in the \"getFirstNameRequest\" method: "));
		tr.addElement(new TD(new Input(Input.TEXT, "type", "")));
		Element b = ECSFactory.makeButton("Submit");
		tr.addElement(new TD(b).setAlign("LEFT"));
		t1.addElement(tr);

		ec.addElement(t1);

		return ec;
	}

	protected Element createContent(WebSession s)
	{
		return super.createStagedContent(s);
	}

	protected Element doStage1(WebSession s) throws Exception
	{
		return viewWsdl(s);
	}

	protected Element doStage2(WebSession s) throws Exception
	{
		return determineType(s);
	}

	protected Element doStage3(WebSession s) throws Exception
	{
		return createSoapEnvelope(s);
	}

	protected Element viewWsdl(WebSession s)
	{
		ElementContainer ec = new ElementContainer();

		// DEVNOTE: Test for stage completion.
		try
		{
			int operationCount = 0;
			operationCount = s.getParser().getIntParameter("count");

			if (operationCount == 4)
			{
				getLessonTracker(s).setStage(2);
				s.setMessage("Stage 1 completed.");

				// Redirect user to Stage2 content.
				ec.addElement(doStage2(s));
			}
			else
			{
				s.setMessage("Sorry, that is an incorrect count. Try Again.");
			}
		} catch (NumberFormatException nfe)
		{
			// DEVNOTE: Eat the exception.
			// ec.addElement( new P().addElement( nfe.getMessage() ) );
			s.setMessage("Sorry, that answer is invalid. Try again.");
		} catch (ParameterNotFoundException pnfe)
		{
			// DEVNOTE: Eat the exception.
			// ec.addElement( new P().addElement( pnfe.getMessage() ) );
		} catch (Exception e)
		{
			s.setMessage("Error generating " + this.getClass().getName());
			e.printStackTrace();
		}

		// DEVNOTE: Conditionally display Stage1 content depending on whether stage is completed or
		// not
		if (getLessonTracker(s).getStage() == 1)
		// if ( null == (getLessonTracker(s).getLessonProperties().getProperty(WebSession.STAGE)) ||
		// (getLessonTracker(s).getLessonProperties().getProperty(WebSession.STAGE)).equals("1") )
		{
			ec.addElement(makeOperationsLine(s));

			A a = new A("services/SoapRequest?WSDL", "WebGoat WSDL File");
			ec.addElement(new P().addElement("View the following WSDL and count available operations:"));
			ec.addElement(new BR());
			ec.addElement(a);
		}

		// getLessonTracker( s ).setCompleted( SoapRequest.completed );

		return (ec);
	}

	protected Element determineType(WebSession s)
	{
		ElementContainer ec = new ElementContainer();

		// DEVNOTE: Test for stage completion.
		try
		{
			String paramType = "";
			paramType = s.getParser().getStringParameter("type");

			// if (paramType.equalsIgnoreCase("int"))
			if (paramType.equals("int"))
			{
				getLessonTracker(s).setStage(3);
				s.setMessage("Stage 2 completed. ");
				// s.setMessage(
				// "Now, you'll craft a SOAP envelope for invoking a web service directly.");

				// Redirect user to Stage2 content.
				ec.addElement(doStage3(s));
			}
			else
			{
				s.setMessage("Sorry, that is an incorrect type. Try Again.");
			}
		} catch (ParameterNotFoundException pnfe)
		{
			// DEVNOTE: Eat the exception.
			// ec.addElement( new P().addElement( pnfe.getMessage() ) );
		} catch (Exception e)
		{
			s.setMessage("Error generating " + this.getClass().getName());
			e.printStackTrace();
		}

		// DEVNOTE: Conditionally display Stage2 content depending on whether stage is completed or
		// not
		if (getLessonTracker(s).getStage() == 2)
		// if ( null == (getLessonTracker(s).getLessonProperties().getProperty(WebSession.STAGE)) ||
		// (getLessonTracker(s).getLessonProperties().getProperty(WebSession.STAGE)).equals("2") )
		{
			ec.addElement(makeTypeLine(s));

			A a = new A("services/SoapRequest?WSDL", "WebGoat WSDL File");
			ec.addElement(new P().addElement("View the following WSDL and count available operations:"));
			ec.addElement(new BR());
			ec.addElement(a);
		}

		// getLessonTracker( s ).setCompleted( SoapRequest.completed );

		return (ec);
	}

	protected Element createSoapEnvelope(WebSession s)
	{
		ElementContainer ec = new ElementContainer();

		// Determine how many methods have been accessed. User needs to check at least two methods
		// before completing the lesson.
		if ((accessFirstName + accessLastName + accessCreditCard + accessLoginCount) >= 2)
		{
			/** Reset function access counters **/
			accessFirstName = accessLastName = accessCreditCard = accessLoginCount = 0;
			// SoapRequest.completed = true;
			makeSuccess(s);
		}
		else
		{

			// display Stage2 content
			ec
					.addElement(new P()
							.addElement("Intercept the request and invoke any method by sending a valid SOAP request for a valid account. <br>"));
			Element b = ECSFactory.makeButton("Press to generate an HTTP request");
			ec.addElement(b);

			// conditionally display invoked methods
			if ((accessFirstName + accessLastName + accessCreditCard + accessLoginCount) > 0)
			{
				ec.addElement("<br><br>Methods Invoked:<br>");
				ec.addElement("<ul>");
				if (accessFirstName > 0)
				{
					ec.addElement("<li>getFirstName</li>");
				}
				if (accessLastName > 0)
				{
					ec.addElement("<li>getLastName</li>");
				}
				if (accessCreditCard > 0)
				{
					ec.addElement("<li>getCreditCard</li>");
				}
				if (accessLoginCount > 0)
				{
					ec.addElement("<li>getLoginCount</li>");
				}
				ec.addElement("</ul>");
			}

			A a = new A("services/SoapRequest?WSDL", "WebGoat WSDL File");
			ec.addElement(new BR());
			ec.addElement(a);
		}

		// getLessonTracker( s ).setCompleted( SoapRequest.completed );
		return (ec);
	}

	public String getResults(int id, String field)
	{
		try
		{
			Connection connection = DatabaseUtilities.getConnection("guest", getWebgoatContext());
			PreparedStatement ps = connection.prepareStatement("SELECT * FROM user_data WHERE userid = ?");
			ps.setInt(1, id);
			try
			{
				ResultSet results = ps.executeQuery();
				if ((results != null) && (results.next() == true)) { return results.getString(field); }
			} catch (SQLException sqle)
			{
			}
		} catch (Exception e)
		{
		}
		return null;
	}

	public String getCreditCard(int id)
	{
		String result = getResults(id, "cc_number");
		// SoapRequest.completed = true;

		if (result != null)
		{
			// DEVNOTE: Always set method access counter to (1) no matter how many times it is
			// accessed.
			// This is intended to be used to determine how many methods have been accessed, not how
			// often.
			accessCreditCard = 1;
			return result;
		}
		return null;
	}

	public String getFirstName(int id)
	{
		String result = getResults(id, "first_name");
		if (result != null)
		{
			// DEVNOTE: Always set method access counter to (1) no matter how many times it is
			// accessed.
			// This is intended to be used to determine how many methods have been accessed, not how
			// often.
			accessFirstName = 1;
			return result;
		}
		return null;
	}

	public String getLastName(int id)
	{
		String result = getResults(id, "last_name");
		if (result != null)
		{
			// DEVNOTE: Always set method access counter to (1) no matter how many times it is
			// accessed.
			// This is intended to be used to determine how many methods have been accessed, not how
			// often.
			accessLastName = 1;
			return result;
		}
		return null;
	}

	public String getLoginCount(int id)
	{
		String result = getResults(id, "login_count");
		if (result != null)
		{
			// DEVNOTE: Always set method access counter to (1) no matter how many times it is
			// accessed.
			// This is intended to be used to determine how many methods have been accessed, not how
			// often.
			accessLoginCount = 1;
			return result;
		}
		return null;
	}
}