Skip to content

Commit f7a1892

Browse files
michaeldevermichaeldever
committed
First pass at removing server dependence in user model
1 parent d21d9b6 commit f7a1892

File tree

5 files changed

+221
-4
lines changed

5 files changed

+221
-4
lines changed

‎src/main/java/org/owasp/webgoat/session/Role.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package org.owasp.webgoat.session;
2+
3+
public class Role {
4+
private String rolename;
5+
6+
public Role(String rolename) {
7+
this.rolename = rolename;
8+
}
9+
10+
public String getRolename() {
11+
return this.rolename;
12+
}
13+
}

‎src/main/java/org/owasp/webgoat/session/User.java‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
package org.owasp.webgoat.session;
2+
3+
import java.util.ArrayList;
4+
import java.util.Iterator;
5+
6+
public class User {
7+
private String username;
8+
private ArrayList<Role> roles;
9+
10+
public User(String username) {
11+
this.username = username;
12+
this.roles = new ArrayList<Role>();
13+
}
14+
15+
public String getUsername() {
16+
return username;
17+
}
18+
19+
public Iterator<Role> getRoles() {
20+
return roles.iterator();
21+
}
22+
23+
public void addRole(String rolename) {
24+
roles.add(new Role(rolename));
25+
}
26+
}

‎src/main/java/org/owasp/webgoat/session/UserDatabase.java‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
package org.owasp.webgoat.session;
2+
3+
import java.sql.*;
4+
import java.util.ArrayList;
5+
import java.util.Iterator;
6+
7+
class UserDatabase {
8+
private Connection userDB;
9+
private final String USER_DB_URI = "jdbc:h2:userDatabase";
10+
11+
private final String CREATE_USERS_TABLE = "CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY, username VARCHAR(255) NOT NULL UNIQUE, password VARCHAR(255) NOT NULL);";
12+
private final String CREATE_ROLES_TABLE = "CREATE TABLE IF NOT EXISTS roles (id INTEGER PRIMARY KEY, rolename VARCHAR(255) NOT NULL UNIQUE);";
13+
private final String CREATE_USER_ROLES_TABLE = "CREATE TABLE IF NOT EXISTS user_roles (id INTEGER PRIMARY KEY, user_id INTEGER NOT NULL, role_id INTEGER NOT NULL);";
14+
private final String CREATE_USER_ROLES_USER_KEY = "ALTER TABLE user_roles ADD CONSTRAINT user_key FOREIGN KEY user_id REFERENCES users(id);";
15+
private final String CREATE_USER_ROLES_ROLE_KEY = "ALTER TABLE user_roles ADD CONSTRAINT role_key FOREIGN KEY role_id REFERENCES roles(id);";
16+
private final String ADD_DEFAULT_USERS = "INSERT INTO users (username, password) VALUES ('webgoat','webgoat'),('basic','basic'),('guest','guest');";
17+
private final String ADD_DEFAULT_ROLES = "INSERT INTO roles (rolename) VALUES ('webgoat_basic'),('webgoat_admin'),('webgoat_user');";
18+
private final String ADD_ROLE_TO_USER = "INSERT INTO user_roles (user_id, role_id) VALUES SELECT users.id, roles.id FROM users, roles WHERE users.username = ? AND roles.rolename = ?;";
19+
20+
private final String QUERY_ALL_USERS = "SELECT username FROM users;";
21+
private final String QUERY_ALL_ROLES_FOR_USERNAME = "SELECT rolename FROM roles WHERE roles.id = user_roles.role_id AND user_roles.user_id = users.id AND users.username = ?;";
22+
23+
private final String DELETE_ALL_ROLES_FOR_USER = "DELETE FROM roles WHERE roles.user_id = users.id and users.username = ?;";
24+
private final String DELETE_USER = "DELETE FROM users WHERE user.username = ?;";
25+
26+
public UserDatabase() {
27+
createDefaultTables();
28+
createDefaultUsers();
29+
createDefaultRoles();
30+
addDefaultRolesToDefaultUsers();
31+
}
32+
33+
public boolean open() {
34+
try {
35+
if (userDB == null || userDB.isClosed()) {
36+
Class.forName("org.h2.Driver");
37+
userDB = DriverManager.getConnection(USER_DB_URI, "webgoat_admin", "");
38+
}
39+
} catch (Exception e) {
40+
return false;
41+
}
42+
return true;
43+
}
44+
45+
public boolean close() {
46+
try {
47+
if (userDB != null && !userDB.isClosed())
48+
userDB.close();
49+
} catch (SQLException e) {
50+
return false;
51+
}
52+
return true;
53+
}
54+
55+
public Iterator<User> getUsers() {
56+
ArrayList<User> users = new ArrayList<User>();
57+
User currentUser;
58+
ResultSet userResults, roleResults;
59+
60+
try {
61+
open();
62+
Statement statement = userDB.createStatement();
63+
PreparedStatement rolesForUsers = userDB.prepareStatement(QUERY_ALL_ROLES_FOR_USERNAME);
64+
65+
userResults = statement.executeQuery(QUERY_ALL_USERS);
66+
while (userResults.next()) {
67+
currentUser = new User(userResults.getString("username"));
68+
rolesForUsers.setString(1, currentUser.getUsername());
69+
roleResults = rolesForUsers.executeQuery();
70+
while (roleResults.next()) {
71+
currentUser.addRole(roleResults.getString("rolename"));
72+
}
73+
roleResults.close();
74+
}
75+
rolesForUsers.close();
76+
userResults.close();
77+
close();
78+
} catch (SQLException e) {
79+
users = new ArrayList<User>();
80+
}
81+
82+
return users.iterator();
83+
}
84+
85+
public boolean addRoleToUser(String username, String rolename) {
86+
try {
87+
open();
88+
PreparedStatement statement = userDB.prepareStatement(ADD_ROLE_TO_USER);
89+
statement.setString(1, username);
90+
statement.setString(2, rolename);
91+
statement.execute();
92+
statement.close();
93+
close();
94+
} catch (SQLException e) {
95+
return false;
96+
}
97+
return true;
98+
}
99+
100+
public boolean removeUser(User user) {
101+
return removeUser(user.getUsername());
102+
}
103+
104+
public boolean removeUser(String username) {
105+
try {
106+
open();
107+
108+
PreparedStatement deleteUserRoles = userDB.prepareStatement(DELETE_ALL_ROLES_FOR_USER);
109+
PreparedStatement deleteUser = userDB.prepareStatement(DELETE_USER);
110+
111+
deleteUserRoles.setString(1, username);
112+
deleteUser.setString(1, username);
113+
114+
deleteUserRoles.execute();
115+
deleteUser.execute();
116+
117+
deleteUserRoles.close();
118+
deleteUser.close();
119+
120+
close();
121+
} catch (SQLException e) {
122+
return false;
123+
}
124+
return true;
125+
}
126+
127+
/*
128+
* Methods to initialise the default state of the database.
129+
*/
130+
131+
private boolean createDefaultTables() {
132+
try {
133+
open();
134+
Statement statement = userDB.createStatement();
135+
statement.execute(CREATE_USERS_TABLE);
136+
statement.execute(CREATE_ROLES_TABLE);
137+
statement.execute(CREATE_USER_ROLES_TABLE);
138+
statement.execute(CREATE_USER_ROLES_USER_KEY);
139+
statement.execute(CREATE_USER_ROLES_ROLE_KEY);
140+
statement.close();
141+
close();
142+
} catch (SQLException e) {
143+
return false;
144+
}
145+
return true;
146+
}
147+
148+
private boolean createDefaultUsers() {
149+
try {
150+
open();
151+
Statement statement = userDB.createStatement();
152+
statement.execute(ADD_DEFAULT_USERS);
153+
statement.close();
154+
close();
155+
} catch (SQLException e) {
156+
return false;
157+
}
158+
return true;
159+
}
160+
161+
private boolean createDefaultRoles() {
162+
try {
163+
open();
164+
Statement statement = userDB.createStatement();
165+
statement.execute(ADD_DEFAULT_ROLES);
166+
statement.close();
167+
close();
168+
} catch (SQLException e) {
169+
return false;
170+
}
171+
return true;
172+
}
173+
174+
private void addDefaultRolesToDefaultUsers() {
175+
addRoleToUser("webgoat", "webgoat_admin");
176+
addRoleToUser("basic", "webgoat_user");
177+
addRoleToUser("basic", "webgoat_basic");
178+
addRoleToUser("guest", "webgoat_user");
179+
}
180+
}

‎src/main/java/org/owasp/webgoat/session/UserTracker.java‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,6 @@
66
import java.util.HashMap;
77
import java.util.Iterator;
88
import java.util.Map;
9-
import org.apache.catalina.Role;
10-
import org.apache.catalina.User;
11-
import org.apache.catalina.users.MemoryUserDatabase;
129

1310

1411
/***************************************************************************************************
@@ -51,7 +48,7 @@ public class UserTracker
5148

5249
private static HashMap<String, HashMap<String, LessonTracker>> storage = new HashMap<String, HashMap<String, LessonTracker>>();
5350

54-
private static MemoryUserDatabase usersDB = new MemoryUserDatabase();
51+
private static UserDatabase usersDB = new UserDatabase();
5552

5653
/**
5754
* Constructor for the UserTracker object

‎src/main/java/org/owasp/webgoat/session/WebSession.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -227,6 +227,7 @@ public class WebSession {
227227
public WebSession(WebgoatContext webgoatContext, ServletContext context) {
228228
this.webgoatContext = webgoatContext;
229229
// initialize from web.xml
230+
System.out.println("Here");
230231
showParams = webgoatContext.isShowParams();
231232
showCookies = webgoatContext.isShowCookies();
232233
showSource = webgoatContext.isShowSource();

0 commit comments

Comments
 (0)