Skip to content

Commit d6e68e4

Browse files
act-iveact-ive
committed
Merged branch 'next' of https://github.com/WebGoat/WebGoat into next
2 parents ea81253 + 1c72097 commit d6e68e4

File tree

321 files changed

+896
-229
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

321 files changed

+896
-229
lines changed

‎README.txt‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,13 @@
33
********** August 23, 2014
44
**********
55
**
6-
** Home Page: http://code.google.com/p/webgoat
7-
** Home Page: http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
8-
** Source Code: http://code.google.com/p/webgoat/source/checkout
9-
** Download: http://code.google.com/p/webgoat/downloads/list
10-
** Download: http://sourceforge.net/project/showfiles.php?group_id=64424&package_id=61824 (older stuff)
11-
** User Guide: http://www.owasp.org/index.php/WebGoat_User_and_Install_Guide_Table_of_Contents
12-
** Wiki: http://code.google.com/p/webgoat/w/list
13-
** FAQ: http://code.google.com/p/webgoat/wiki/FAQ
6+
** Home Page: http://webgoat.github.io
7+
** Home Page: http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
8+
** Source Code: https://github.com/WebGoat/WebGoat
9+
** Easy-Run Download: https://webgoat.atlassian.net/builds/browse/WEB-DAIL/latestSuccessful/artifact/JOB1/WebGoat-Embedded-Tomcat/WebGoat-6.0-SNAPSHOT-war-exec.jar
10+
** User Guide: http://www.owasp.org/index.php/WebGoat_User_and_Install_Guide_Table_of_Contents
11+
** Wiki: http://code.google.com/p/webgoat/w/list
12+
** FAQ: http://code.google.com/p/webgoat/wiki/FAQ
1413
** Contact Info: [email protected] (Direct to Bruce Mayhew)
1514
** Mailing List: [email protected] (WebGoat Community - For most questions)
1615
**
@@ -45,7 +44,7 @@ Follow these instructions if you simply wish to run WebGoat
4544

4645
Prerequisites: Java VM >= 1.6 installed ( JDK 1.7 recommended)
4746
Download the executable jar file to any location of your choice from:
48-
http://github.com/path/to/download/WebGoat-6.0-exec-war.jar
47+
https://webgoat.atlassian.net/builds/browse/WEB-DAIL/latestSuccessful/artifact/JOB1/WebGoat-Embedded-Tomcat/WebGoat-6.0-SNAPSHOT-war-exec.jar
4948

5049
Run it using java:
5150
java -jar WebGoat-6.0-exec-war.jar

‎newDesign/index.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@
164164
<div class="col-md-12">
165165
<div class="panel">
166166
<div class="panel-body">
167-
<h1>About WebGoat</h1>
167+
<h1>About WebGoat</h1> <span style="btn">Text</span>
168168
<hr />
169169
<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Quisque volutpat feugiat nunc, non vulputate urna dictum ut. Nam consectetur porttitor diam ut ultricies. Aenean dolor dolor, congue sed ornare non, elementum in mauris. Phasellus orci sem, rhoncus eu laoreet eu, aliquam nec ante. Suspendisse sit amet justo eget eros tempor tincidunt vel quis justo. Sed pulvinar enim id neque pellentesque, eu rhoncus lorem eleifend. Morbi congue tortor sit amet pulvinar posuere.</p>
170170
<p>Integer rhoncus gravida arcu, at bibendum magna feugiat sit amet. Vivamus id lacinia massa. Praesent eu quam ullamcorper, tempor elit nec, lobortis massa. In in eros eu augue rhoncus semper. Vestibulum ornare purus vitae bibendum vulputate. Cras eleifend commodo lectus, eget pharetra justo mollis quis. Donec tempor magna lectus, vitae suscipit turpis venenatis et. Nulla facilisi.</p>

‎pom.xml‎

Lines changed: 25 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,14 @@
2222
</properties>
2323

2424
<build>
25+
<resources>
26+
<resource>
27+
<directory>${basedir}/src/main/java</directory>
28+
</resource>
29+
<resource>
30+
<directory>${basedir}/src/main/resources</directory>
31+
</resource>
32+
</resources>
2533
<plugins>
2634
<plugin>
2735
<groupId>org.apache.maven.plugins</groupId>
@@ -33,23 +41,23 @@
3341
</configuration>
3442
</plugin>
3543
<plugin>
36-
<groupId>org.apache.tomcat.maven</groupId>
37-
<artifactId>tomcat7-maven-plugin</artifactId>
38-
<version>2.1</version>
39-
<executions>
40-
<execution>
41-
<id>tomcat-run</id>
42-
<goals>
43-
<goal>exec-war-only</goal>
44-
</goals>
45-
<phase>package</phase>
46-
<configuration>
47-
<url>http://localhost:8080/manager</url>
48-
<path>/WebGoat</path>
49-
<attachArtifactClassifier>exec</attachArtifactClassifier>
50-
</configuration>
51-
</execution>
52-
</executions>
44+
<groupId>org.apache.tomcat.maven</groupId>
45+
<artifactId>tomcat7-maven-plugin</artifactId>
46+
<version>2.1</version>
47+
<executions>
48+
<execution>
49+
<id>tomcat-run</id>
50+
<goals>
51+
<goal>exec-war-only</goal>
52+
</goals>
53+
<phase>package</phase>
54+
<configuration>
55+
<url>http://localhost:8080/manager</url>
56+
<path>/WebGoat</path>
57+
<attachArtifactClassifier>exec</attachArtifactClassifier>
58+
</configuration>
59+
</execution>
60+
</executions>
5361
</plugin>
5462
</plugins>
5563
</build>

‎src/main/java/org/owasp/webgoat/HammerHead.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,7 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
129129
// FIXME: If a response is written by updateSession(), do not
130130
// call makeScreen() and writeScreen()
131131
mySession = updateSession(request, response, context);
132+
132133
if (response.isCommitted()) {
133134
logger.debug("Response already committed, exiting");
134135
return;

‎src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@
3030
import org.owasp.webgoat.session.WebSession;
3131
import org.owasp.webgoat.session.WebgoatContext;
3232
import org.owasp.webgoat.session.WebgoatProperties;
33+
import org.slf4j.Logger;
34+
import org.slf4j.LoggerFactory;
3335

3436
/**
3537
* *************************************************************************************************
@@ -66,6 +68,8 @@
6668
*/
6769
public abstract class AbstractLesson extends Screen implements Comparable<Object> {
6870

71+
final Logger logger = LoggerFactory.getLogger(AbstractLesson.class);
72+
6973
/**
7074
* Description of the Field
7175
*/
@@ -496,9 +500,8 @@ public String getRawSource(WebSession s) {
496500
String src;
497501

498502
try {
499-
// System.out.println("Loading source file: " +
500-
// getSourceFileName());
501-
src = readFromFile(new BufferedReader(new FileReader(s.getWebResource(getSourceFileName()))), true);
503+
logger.debug("Loading source file: " + getSourceFileName());
504+
src = readFromFile(new BufferedReader(new FileReader(s.getWebResource(getSourceFileName()))), false);
502505

503506
} catch (FileNotFoundException e) {
504507
s.setMessage("Could not find source file");
@@ -782,8 +785,7 @@ public String getSourceFileName() {
782785
}
783786

784787
public void setSourceFileName(String sourceFileName) {
785-
// System.out.println("Setting source file of lesson " + this + " to: "
786-
// + sourceFileName);
788+
logger.debug("Setting source file of lesson " + this + " to: " + sourceFileName);
787789
this.sourceFileName = sourceFileName;
788790
}
789791

‎src/main/java/org/owasp/webgoat/service/BaseService.java‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@
3030
*/
3131
package org.owasp.webgoat.service;
3232

33+
import java.io.PrintWriter;
34+
import java.io.StringWriter;
3335
import javax.servlet.http.HttpServletRequest;
3436
import javax.servlet.http.HttpSession;
3537
import org.owasp.webgoat.controller.Welcome;
@@ -59,7 +61,8 @@ ExceptionInfo handleException(HttpServletRequest request, Exception ex) {
5961
logger.error("Exception handler for service caught exception when processing: " + url, ex);
6062
ExceptionInfo response = new ExceptionInfo();
6163
response.setUrl(url);
62-
response.setMessage(ex.toString());
64+
65+
response.setMessage(getStringStackTrace(ex));
6366

6467
return response;
6568
}
@@ -77,4 +80,10 @@ public WebSession getWebSession(HttpSession session) {
7780
return ws;
7881
}
7982

83+
public String getStringStackTrace(Throwable t){
84+
StringWriter sw = new StringWriter();
85+
PrintWriter pw = new PrintWriter(sw);
86+
t.printStackTrace(pw);
87+
return sw.toString();
88+
}
8089
}

‎src/main/java/org/owasp/webgoat/service/CookieService.java‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,16 @@
3030
*/
3131
package org.owasp.webgoat.service;
3232

33+
import java.util.Collections;
3334
import java.util.List;
3435
import javax.servlet.http.Cookie;
3536
import javax.servlet.http.HttpSession;
37+
import org.owasp.webgoat.lessons.model.RequestParameter;
3638
import org.owasp.webgoat.session.WebSession;
3739
import org.springframework.stereotype.Controller;
3840
import org.springframework.web.bind.annotation.RequestMapping;
3941
import org.springframework.web.bind.annotation.ResponseBody;
42+
import org.springframework.web.servlet.ModelAndView;
4043

4144
/**
4245
*
@@ -58,4 +61,23 @@ List<Cookie> showCookies(HttpSession session) {
5861
List<Cookie> cookies = ws.getCookiesOnLastRequest();
5962
return cookies;
6063
}
64+
65+
/**
66+
* Returns cookies and params for current lesson
67+
*
68+
* @param session
69+
* @return
70+
*/
71+
@RequestMapping(value = "/cookies_widget.mvc", produces = "text/html")
72+
public ModelAndView showCookiesAndParamsAsHtml(HttpSession session) {
73+
ModelAndView model = new ModelAndView();
74+
WebSession ws = getWebSession(session);
75+
List<Cookie> cookies = ws.getCookiesOnLastRequest();
76+
List<RequestParameter> listParms = ws.getParmsOnLastRequest();
77+
Collections.sort(listParms);
78+
model.addObject("wgcookies", cookies);
79+
model.addObject("wgparams", listParms);
80+
model.setViewName("widgets/cookies_and_params");
81+
return model;
82+
}
6183
}

‎src/main/java/org/owasp/webgoat/service/HintService.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
import org.springframework.stereotype.Controller;
1515
import org.springframework.web.bind.annotation.RequestMapping;
1616
import org.springframework.web.bind.annotation.ResponseBody;
17+
import org.springframework.web.servlet.ModelAndView;
1718

1819
/**
1920
*
@@ -53,4 +54,33 @@ List<Hint> showHint(HttpSession session) {
5354
}
5455
return listHints;
5556
}
57+
58+
@RequestMapping(value = "/hint_widget.mvc", produces = "text/html")
59+
public
60+
ModelAndView showHintsAsHtml(HttpSession session) {
61+
ModelAndView model = new ModelAndView();
62+
List<Hint> listHints = new ArrayList<Hint>();
63+
model.addObject("hints", listHints);
64+
WebSession ws = getWebSession(session);
65+
AbstractLesson l = ws.getCurrentLesson();
66+
if (l == null) {
67+
return model;
68+
}
69+
List<String> hints;
70+
hints = l.getHintsPublic(ws);
71+
if (hints == null) {
72+
return model;
73+
}
74+
int idx = 0;
75+
for (String h : hints) {
76+
Hint hint = new Hint();
77+
hint.setHint(h);
78+
hint.setLesson(l.getName());
79+
hint.setNumber(idx);
80+
listHints.add(hint);
81+
idx++;
82+
}
83+
model.setViewName("widgets/hints");
84+
return model;
85+
}
5686
}

‎src/main/java/org/owasp/webgoat/service/LessonPlanService.java‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -54,14 +54,15 @@ public class LessonPlanService extends BaseService {
5454
* @param session
5555
* @return
5656
*/
57-
@RequestMapping(value = "/lessonplan.mvc", produces = "application/json")
57+
@RequestMapping(value = "/lessonplan.mvc", produces = "application/html")
5858
public @ResponseBody
59-
SourceListing showSource(HttpSession session) {
59+
String showPlan(HttpSession session) {
6060
WebSession ws = getWebSession(session);
61-
String source = getSource(ws);
62-
SourceListing sl = new SourceListing();
63-
sl.setSource(source);
64-
return sl;
61+
String plan = getPlan(ws);
62+
return plan;
63+
//SourceListing sl = new SourceListing();
64+
//sl.setSource(source);
65+
//return sl;
6566
}
6667

6768
/**
@@ -70,9 +71,9 @@ SourceListing showSource(HttpSession session) {
7071
* @param s Description of the Parameter
7172
* @return Description of the Return Value
7273
*/
73-
protected String getSource(WebSession s) {
74+
protected String getPlan(WebSession s) {
7475

75-
String source = null;
76+
String plan = null;
7677
int scr = s.getCurrentScreen();
7778
Course course = s.getCourse();
7879

@@ -81,14 +82,12 @@ protected String getSource(WebSession s) {
8182
AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
8283

8384
if (lesson != null) {
84-
source = lesson.getRawSource(s);
85+
plan = lesson.getLessonPlan(s);
8586
}
8687
}
87-
if (source == null) {
88-
return "Source code is not available. Contact "
89-
+ s.getWebgoatContext().getFeedbackAddressHTML();
88+
if (plan == null) {
89+
plan = "Plan is not available for this lesson.";
9090
}
91-
return (source.replaceAll("(?s)" + START_SOURCE_SKIP + ".*" + END_SOURCE_SKIP,
92-
"Code Section Deliberately Omitted"));
91+
return plan;
9392
}
9493
}

‎src/main/java/org/owasp/webgoat/service/ParameterService.java‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@
3333
import java.util.ArrayList;
3434
import java.util.Collections;
3535
import java.util.List;
36-
import java.util.Map;
3736
import javax.servlet.http.HttpSession;
3837
import org.owasp.webgoat.lessons.model.RequestParameter;
3938
import org.owasp.webgoat.session.WebSession;
@@ -61,9 +60,8 @@ public class ParameterService extends BaseService {
6160
@RequestMapping(value = "/parameter.mvc", produces = "application/json")
6261
public @ResponseBody
6362
List<RequestParameter> showParameters(HttpSession session) {
64-
List<RequestParameter> listParms = new ArrayList<RequestParameter>();
6563
WebSession ws = getWebSession(session);
66-
listParms = ws.getParmsOnLastRequest();
64+
List<RequestParameter> listParms = ws.getParmsOnLastRequest();
6765
Collections.sort(listParms);
6866
return listParms;
6967
}

0 commit comments

Comments
 (0)