89f43229ab
* upgrade springboot version and some related unit test fixes * removed log for test * removed junit version property
111 lines
4.3 KiB
Java
111 lines
4.3 KiB
Java
package org.owasp.webgoat;
|
|
|
|
import static org.junit.jupiter.api.DynamicTest.dynamicTest;
|
|
|
|
import java.io.File;
|
|
import java.io.IOException;
|
|
import java.nio.file.Files;
|
|
import java.nio.file.Path;
|
|
import java.util.Arrays;
|
|
import java.util.Map;
|
|
|
|
import org.hamcrest.CoreMatchers;
|
|
import org.hamcrest.MatcherAssert;
|
|
import org.junit.jupiter.api.AfterEach;
|
|
import org.junit.jupiter.api.BeforeEach;
|
|
import org.junit.jupiter.api.DynamicTest;
|
|
import org.junit.jupiter.api.TestFactory;
|
|
import org.junit.jupiter.api.io.TempDir;
|
|
import org.springframework.security.core.token.Sha512DigestUtils;
|
|
|
|
import io.restassured.RestAssured;
|
|
import lombok.SneakyThrows;
|
|
|
|
public class PathTraversalTest extends IntegrationTest {
|
|
|
|
//the JUnit5 way
|
|
@TempDir
|
|
Path tempDir;
|
|
|
|
private File fileToUpload = null;
|
|
|
|
@BeforeEach
|
|
@SneakyThrows
|
|
public void init() {
|
|
fileToUpload = Files.createFile(
|
|
tempDir.resolve("test.jpg")).toFile();
|
|
Files.write(fileToUpload.toPath(), "This is a test" .getBytes());
|
|
startLesson("PathTraversal");
|
|
}
|
|
|
|
@TestFactory
|
|
Iterable<DynamicTest> testPathTraversal() {
|
|
return Arrays.asList(
|
|
dynamicTest("assignment 1 - profile upload",()-> assignment1()),
|
|
dynamicTest("assignment 2 - profile upload fix",()-> assignment2()),
|
|
dynamicTest("assignment 3 - profile upload remove user input",()-> assignment3()),
|
|
dynamicTest("assignment 4 - profile upload random pic",()-> assignment4())
|
|
);
|
|
}
|
|
|
|
public void assignment1() throws IOException {
|
|
MatcherAssert.assertThat(
|
|
RestAssured.given()
|
|
.when()
|
|
.relaxedHTTPSValidation()
|
|
.cookie("JSESSIONID", getWebGoatCookie())
|
|
.multiPart("uploadedFile", "test.jpg", Files.readAllBytes(fileToUpload.toPath()))
|
|
.param("fullName", "../John Doe")
|
|
.post("/WebGoat/PathTraversal/profile-upload")
|
|
.then()
|
|
.statusCode(200)
|
|
.extract().path("lessonCompleted"), CoreMatchers.is(true));
|
|
}
|
|
|
|
public void assignment2() throws IOException {
|
|
MatcherAssert.assertThat(
|
|
RestAssured.given()
|
|
.when()
|
|
.relaxedHTTPSValidation()
|
|
.cookie("JSESSIONID", getWebGoatCookie())
|
|
.multiPart("uploadedFileFix", "test.jpg", Files.readAllBytes(fileToUpload.toPath()))
|
|
.param("fullNameFix", "..././John Doe")
|
|
.post("/WebGoat/PathTraversal/profile-upload-fix")
|
|
.then()
|
|
.statusCode(200)
|
|
.extract().path("lessonCompleted"), CoreMatchers.is(true));
|
|
}
|
|
|
|
public void assignment3() throws IOException {
|
|
MatcherAssert.assertThat(
|
|
RestAssured.given()
|
|
.when()
|
|
.relaxedHTTPSValidation()
|
|
.cookie("JSESSIONID", getWebGoatCookie())
|
|
.multiPart("uploadedFileRemoveUserInput", "../test.jpg", Files.readAllBytes(fileToUpload.toPath()))
|
|
.post("/WebGoat/PathTraversal/profile-upload-remove-user-input")
|
|
.then()
|
|
.statusCode(200)
|
|
.extract().path("lessonCompleted"), CoreMatchers.is(true));
|
|
}
|
|
public void assignment4() throws IOException {
|
|
var uri = "/WebGoat/PathTraversal/random-picture?id=%2E%2E%2F%2E%2E%2Fpath-traversal-secret";
|
|
RestAssured.given().urlEncodingEnabled(false)
|
|
.when()
|
|
.relaxedHTTPSValidation()
|
|
.cookie("JSESSIONID", getWebGoatCookie())
|
|
.get(uri)
|
|
.then()
|
|
.statusCode(200)
|
|
.content(CoreMatchers.is("You found it submit the SHA-512 hash of your username as answer"));
|
|
|
|
checkAssignment("/WebGoat/PathTraversal/random", Map.of("secret", Sha512DigestUtils.shaHex(getWebgoatUser())), true);
|
|
}
|
|
|
|
@AfterEach
|
|
public void shutdown() {
|
|
//this will run only once after the list of dynamic tests has run, this is to test if the lesson is marked complete
|
|
checkResults("/PathTraversal");
|
|
}
|
|
}
|