Skip to content

Commit 1e58b13

Browse files
nbaarsnbaars
committed
Merge pull request #48 from michaeldever/master
Remove dependence on Tomcat.
2 parents d21d9b6 + 250d7be commit 1e58b13

File tree

6 files changed

+260
-5
lines changed

6 files changed

+260
-5
lines changed

‎pom.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,11 @@
8383

8484
<dependencies>
8585
<dependency>
86+
<groupId>com.h2database</groupId>
87+
<artifactId>h2</artifactId>
88+
<version>1.4.187</version>
89+
</dependency>
90+
<dependency>
8691
<groupId>javax.activation</groupId>
8792
<artifactId>activation</artifactId>
8893
<version>1.1</version>

‎src/main/java/org/owasp/webgoat/session/Role.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package org.owasp.webgoat.session;
2+
3+
public class Role {
4+
private String rolename;
5+
6+
public Role(String rolename) {
7+
this.rolename = rolename;
8+
}
9+
10+
public String getRolename() {
11+
return this.rolename;
12+
}
13+
}

‎src/main/java/org/owasp/webgoat/session/User.java‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
package org.owasp.webgoat.session;
2+
3+
import java.util.ArrayList;
4+
import java.util.Iterator;
5+
6+
public class User {
7+
private String username;
8+
private ArrayList<Role> roles;
9+
10+
public User(String username) {
11+
this.username = username;
12+
this.roles = new ArrayList<Role>();
13+
}
14+
15+
public String getUsername() {
16+
return username;
17+
}
18+
19+
public Iterator<Role> getRoles() {
20+
return roles.iterator();
21+
}
22+
23+
public void addRole(String rolename) {
24+
roles.add(new Role(rolename));
25+
}
26+
}

‎src/main/java/org/owasp/webgoat/session/UserDatabase.java‎

Lines changed: 214 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,214 @@
1+
package org.owasp.webgoat.session;
2+
3+
import java.sql.*;
4+
import java.util.ArrayList;
5+
import java.util.Iterator;
6+
import java.io.File;
7+
8+
class UserDatabase {
9+
private Connection userDB;
10+
private final String USER_DB_URI = "jdbc:h2:" + System.getProperty("user.dir") + File.separator + "UserDatabase";
11+
12+
private final String CREATE_USERS_TABLE = "CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY AUTO_INCREMENT, username VARCHAR(255) NOT NULL UNIQUE);";
13+
private final String CREATE_ROLES_TABLE = "CREATE TABLE IF NOT EXISTS roles (id INTEGER PRIMARY KEY AUTO_INCREMENT, rolename VARCHAR(255) NOT NULL UNIQUE);";
14+
private final String CREATE_USER_ROLES_TABLE = "CREATE TABLE IF NOT EXISTS user_roles (id INTEGER PRIMARY KEY AUTO_INCREMENT, user_id INTEGER NOT NULL, role_id INTEGER NOT NULL, FOREIGN KEY (user_id) REFERENCES users(id), FOREIGN KEY (role_id) REFERENCES roles(id));";
15+
private final String ADD_DEFAULT_USERS = "INSERT INTO users (username) VALUES ('webgoat'),('basic'),('guest');";
16+
private final String ADD_DEFAULT_ROLES = "INSERT INTO roles (rolename) VALUES ('webgoat_basic'),('webgoat_admin'),('webgoat_user');";
17+
private final String ADD_ROLE_TO_USER = "INSERT INTO user_roles (user_id, role_id) SELECT users.id, roles.id FROM users, roles WHERE users.username = ? AND roles.rolename = ?;";
18+
19+
private final String QUERY_ALL_USERS = "SELECT username FROM users;";
20+
private final String QUERY_ALL_ROLES_FOR_USERNAME = "SELECT rolename FROM roles, user_roles, users WHERE roles.id = user_roles.role_id AND user_roles.user_id = users.id AND users.username = ?;";
21+
private final String QUERY_TABLE_COUNT = "SELECT count(id) AS count FROM table;";
22+
23+
private final String DELETE_ALL_ROLES_FOR_USER = "DELETE FROM user_roles WHERE user_id IN (SELECT id FROM users WHERE username = ?);";
24+
private final String DELETE_USER = "DELETE FROM users WHERE username = ?;";
25+
26+
public UserDatabase() {
27+
createDefaultTables();
28+
if (getTableCount("users") <= 0) {
29+
createDefaultUsers();
30+
}
31+
if (getTableCount("roles") <= 0) {
32+
createDefaultRoles();
33+
}
34+
if (getTableCount("user_roles") <= 0) {
35+
addDefaultRolesToDefaultUsers();
36+
}
37+
}
38+
39+
public boolean open() {
40+
try {
41+
if (userDB == null || userDB.isClosed()) {
42+
Class.forName("org.h2.Driver");
43+
userDB = DriverManager.getConnection(USER_DB_URI, "webgoat_admin", "");
44+
}
45+
} catch (SQLException e) {
46+
e.printStackTrace();
47+
return false;
48+
} catch (ClassNotFoundException e) {
49+
e.printStackTrace();
50+
return false;
51+
}
52+
return true;
53+
}
54+
55+
public boolean close() {
56+
try {
57+
if (userDB != null && !userDB.isClosed())
58+
userDB.close();
59+
} catch (SQLException e) {
60+
e.printStackTrace();
61+
return false;
62+
}
63+
return true;
64+
}
65+
66+
public int getTableCount(String tableName) {
67+
int count = 0;
68+
try {
69+
open();
70+
Statement statement = userDB.createStatement();
71+
ResultSet countResult = statement.executeQuery(QUERY_TABLE_COUNT.replace("table", tableName));
72+
if (countResult.next()) {
73+
count = countResult.getInt("count");
74+
}
75+
countResult.close();
76+
statement.close();
77+
close();
78+
} catch (SQLException e) {
79+
e.printStackTrace();
80+
count = -1;
81+
}
82+
return count;
83+
}
84+
85+
public Iterator<User> getUsers() {
86+
ArrayList<User> users = new ArrayList<User>();
87+
User currentUser;
88+
ResultSet userResults, roleResults;
89+
90+
try {
91+
open();
92+
Statement statement = userDB.createStatement();
93+
PreparedStatement rolesForUsers = userDB.prepareStatement(QUERY_ALL_ROLES_FOR_USERNAME);
94+
95+
userResults = statement.executeQuery(QUERY_ALL_USERS);
96+
while (userResults.next()) {
97+
currentUser = new User(userResults.getString("username"));
98+
rolesForUsers.setString(1, currentUser.getUsername());
99+
roleResults = rolesForUsers.executeQuery();
100+
while (roleResults.next()) {
101+
currentUser.addRole(roleResults.getString("rolename"));
102+
}
103+
roleResults.close();
104+
}
105+
rolesForUsers.close();
106+
userResults.close();
107+
close();
108+
} catch (SQLException e) {
109+
e.printStackTrace();
110+
users = new ArrayList<User>();
111+
}
112+
113+
return users.iterator();
114+
}
115+
116+
public boolean addRoleToUser(String username, String rolename) {
117+
try {
118+
open();
119+
PreparedStatement statement = userDB.prepareStatement(ADD_ROLE_TO_USER);
120+
statement.setString(1, username);
121+
statement.setString(2, rolename);
122+
statement.execute();
123+
statement.close();
124+
close();
125+
} catch (SQLException e) {
126+
e.printStackTrace();
127+
return false;
128+
}
129+
return true;
130+
}
131+
132+
public boolean removeUser(User user) {
133+
return removeUser(user.getUsername());
134+
}
135+
136+
public boolean removeUser(String username) {
137+
try {
138+
open();
139+
140+
PreparedStatement deleteUserRoles = userDB.prepareStatement(DELETE_ALL_ROLES_FOR_USER);
141+
PreparedStatement deleteUser = userDB.prepareStatement(DELETE_USER);
142+
143+
deleteUserRoles.setString(1, username);
144+
deleteUser.setString(1, username);
145+
146+
deleteUserRoles.execute();
147+
deleteUser.execute();
148+
149+
deleteUserRoles.close();
150+
deleteUser.close();
151+
152+
close();
153+
} catch (SQLException e) {
154+
e.printStackTrace();
155+
return false;
156+
}
157+
return true;
158+
}
159+
160+
/*
161+
* Methods to initialise the default state of the database.
162+
*/
163+
164+
private boolean createDefaultTables() {
165+
try {
166+
open();
167+
Statement statement = userDB.createStatement();
168+
statement.execute(CREATE_USERS_TABLE);
169+
statement.execute(CREATE_ROLES_TABLE);
170+
statement.execute(CREATE_USER_ROLES_TABLE);
171+
statement.close();
172+
close();
173+
} catch (SQLException e) {
174+
e.printStackTrace();
175+
return false;
176+
}
177+
return true;
178+
}
179+
180+
private boolean createDefaultUsers() {
181+
try {
182+
open();
183+
Statement statement = userDB.createStatement();
184+
statement.execute(ADD_DEFAULT_USERS);
185+
statement.close();
186+
close();
187+
} catch (SQLException e) {
188+
e.printStackTrace();
189+
return false;
190+
}
191+
return true;
192+
}
193+
194+
private boolean createDefaultRoles() {
195+
try {
196+
open();
197+
Statement statement = userDB.createStatement();
198+
statement.execute(ADD_DEFAULT_ROLES);
199+
statement.close();
200+
close();
201+
} catch (SQLException e) {
202+
e.printStackTrace();
203+
return false;
204+
}
205+
return true;
206+
}
207+
208+
private void addDefaultRolesToDefaultUsers() {
209+
addRoleToUser("webgoat", "webgoat_admin");
210+
addRoleToUser("basic", "webgoat_user");
211+
addRoleToUser("basic", "webgoat_basic");
212+
addRoleToUser("guest", "webgoat_user");
213+
}
214+
}

‎src/main/java/org/owasp/webgoat/session/UserTracker.java‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,6 @@
66
import java.util.HashMap;
77
import java.util.Iterator;
88
import java.util.Map;
9-
import org.apache.catalina.Role;
10-
import org.apache.catalina.User;
11-
import org.apache.catalina.users.MemoryUserDatabase;
129

1310

1411
/***************************************************************************************************
@@ -51,7 +48,7 @@ public class UserTracker
5148

5249
private static HashMap<String, HashMap<String, LessonTracker>> storage = new HashMap<String, HashMap<String, LessonTracker>>();
5350

54-
private static MemoryUserDatabase usersDB = new MemoryUserDatabase();
51+
private static UserDatabase usersDB = new UserDatabase();
5552

5653
/**
5754
* Constructor for the UserTracker object

‎src/main/tomcatconf/tomcat-users.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@
88
<user password="basic" roles="webgoat_user,webgoat_basic" username="basic"/>
99
<user password="tomcat" roles="tomcat" username="tomcat"/>
1010
<user password="guest" roles="webgoat_user" username="guest"/>
11-
</tomcat-users>
11+
</tomcat-users>

0 commit comments

Comments
 (0)