From 93253e95db4c21ddb7c1f3bf4756cc05cebb2f6d Mon Sep 17 00:00:00 2001 From: ilijakstc <149958955+ilijakstc@users.noreply.github.com> Date: Wed, 10 Dec 2025 18:27:51 +0100 Subject: [PATCH 1/3] test run --- .../java/org/owasp/benchmark/testcode/BenchmarkTest00032.java | 1 + 1 file changed, 1 insertion(+) diff --git a/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00032.java b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00032.java index 2f829c2918..8851a1ab20 100644 --- a/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00032.java +++ b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00032.java @@ -24,6 +24,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +// ToDo: Review files @WebServlet(value = "/sqli-00/BenchmarkTest00032") public class BenchmarkTest00032 extends HttpServlet { From 0151e9839a8aaa8370f2f34d67008fcc3d00484b Mon Sep 17 00:00:00 2001 From: ilijakstc <149958955+ilijakstc@users.noreply.github.com> Date: Wed, 10 Dec 2025 18:45:35 +0100 Subject: [PATCH 2/3] test run 2 --- .../benchmark/copilot/BenchmarkTest00032.java | 69 +++++++++++++++++++ 1 file changed, 69 insertions(+) create mode 100644 src/main/java/org/owasp/benchmark/copilot/BenchmarkTest00032.java diff --git a/src/main/java/org/owasp/benchmark/copilot/BenchmarkTest00032.java b/src/main/java/org/owasp/benchmark/copilot/BenchmarkTest00032.java new file mode 100644 index 0000000000..d336a699bf --- /dev/null +++ b/src/main/java/org/owasp/benchmark/copilot/BenchmarkTest00032.java @@ -0,0 +1,69 @@ +/** + * OWASP Benchmark v1.2 + * + *

This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For + * details, please see https://owasp.org/www-project-benchmark/. + * + *

The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms + * of the GNU General Public License as published by the Free Software Foundation, version 2. + * + *

The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR + * PURPOSE. See the GNU General Public License for more details. + * + * @author Dave Wichers + * @created 2015 + */ +package org.owasp.benchmark.copilot; + +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; + +// ToDo: Review files +@WebServlet(value = "/sqli-00/BenchmarkTest00032") +public class BenchmarkTest00032 extends HttpServlet { + + private static final long serialVersionUID = 1L; + + @Override + public void doGet(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + doPost(request, response); + } + + @Override + public void doPost(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + // some code + response.setContentType("text/html;charset=UTF-8"); + + java.util.Map map = request.getParameterMap(); + String param = ""; + if (!map.isEmpty()) { + String[] values = map.get("BenchmarkTest00032"); + if (values != null) param = values[0]; + } + + try { + String sql = "SELECT * from USERS where USERNAME='foo' and PASSWORD='" + param + "'"; + + org.owasp.benchmark.helpers.DatabaseHelper.JDBCtemplate.execute(sql); + response.getWriter() + .println( + "No results can be displayed for query: " + + org.owasp.esapi.ESAPI.encoder().encodeForHTML(sql) + + "
" + + " because the Spring execute method doesn't return results."); + + } catch (org.springframework.dao.DataAccessException e) { + if (org.owasp.benchmark.helpers.DatabaseHelper.hideSQLErrors) { + response.getWriter().println("Error processing request."); + } else throw new ServletException(e); + } + } +} From 4c70bbad67fd6a4ec6d38a50e6970f423ab574b7 Mon Sep 17 00:00:00 2001 From: ilijakstc <149958955+ilijakstc@users.noreply.github.com> Date: Wed, 10 Dec 2025 18:56:14 +0100 Subject: [PATCH 3/3] test run 3 --- .../testcode/BenchmarkTest00032.java | 69 ------------------- 1 file changed, 69 deletions(-) delete mode 100644 src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00032.java diff --git a/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00032.java b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00032.java deleted file mode 100644 index 8851a1ab20..0000000000 --- a/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00032.java +++ /dev/null @@ -1,69 +0,0 @@ -/** - * OWASP Benchmark v1.2 - * - *

This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For - * details, please see https://owasp.org/www-project-benchmark/. - * - *

The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms - * of the GNU General Public License as published by the Free Software Foundation, version 2. - * - *

The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR - * PURPOSE. See the GNU General Public License for more details. - * - * @author Dave Wichers - * @created 2015 - */ -package org.owasp.benchmark.testcode; - -import java.io.IOException; -import javax.servlet.ServletException; -import javax.servlet.annotation.WebServlet; -import javax.servlet.http.HttpServlet; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; - -// ToDo: Review files -@WebServlet(value = "/sqli-00/BenchmarkTest00032") -public class BenchmarkTest00032 extends HttpServlet { - - private static final long serialVersionUID = 1L; - - @Override - public void doGet(HttpServletRequest request, HttpServletResponse response) - throws ServletException, IOException { - doPost(request, response); - } - - @Override - public void doPost(HttpServletRequest request, HttpServletResponse response) - throws ServletException, IOException { - // some code - response.setContentType("text/html;charset=UTF-8"); - - java.util.Map map = request.getParameterMap(); - String param = ""; - if (!map.isEmpty()) { - String[] values = map.get("BenchmarkTest00032"); - if (values != null) param = values[0]; - } - - try { - String sql = "SELECT * from USERS where USERNAME='foo' and PASSWORD='" + param + "'"; - - org.owasp.benchmark.helpers.DatabaseHelper.JDBCtemplate.execute(sql); - response.getWriter() - .println( - "No results can be displayed for query: " - + org.owasp.esapi.ESAPI.encoder().encodeForHTML(sql) - + "
" - + " because the Spring execute method doesn't return results."); - - } catch (org.springframework.dao.DataAccessException e) { - if (org.owasp.benchmark.helpers.DatabaseHelper.hideSQLErrors) { - response.getWriter().println("Error processing request."); - } else throw new ServletException(e); - } - } -}