Skip to content

Commit fb938e0

Browse files
author
[email protected]
committed
Initial commit of new spring-MVC/spring security/tiles-based functionality
git-svn-id: http://webgoat.googlecode.com/svn/branches/webgoat-6.0@484 4033779f-a91e-0410-96ef-6bf7bf53c507
1 parent 65f73a5 commit fb938e0

File tree

17 files changed

+884
-19
lines changed

17 files changed

+884
-19
lines changed

‎build.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,8 @@
6060
<property name="dist.home" value="${app.home}/dist"/>
6161
<property name="dist.owasp" value="${app.home}/owasp_distributions"/>
6262
<property name="install.home" value="WebGoat-${app.version}"/>
63-
<property name="maven.war" value="${basedir}/target/WebGoat-5.4-SNAPSHOT.war"/> <!-- UPDATE THIS! -->
64-
<property name="maven.target" value="${basedir}/target/WebGoat-5.4-SNAPSHOT"/> <!-- UPDATE THIS! -->
63+
<property name="maven.war" value="${basedir}/target/WebGoat-6.0-SNAPSHOT.war"/> <!-- UPDATE THIS! -->
64+
<property name="maven.target" value="${basedir}/target/WebGoat-6.0-SNAPSHOT"/> <!-- UPDATE THIS! -->
6565
<property name="maven.home" value="C:/Program Files (x86)/apache/apache-maven-3.0.3"/> <!-- UPDATE THIS! -->
6666
<property name="java32.home" value="C:/Program Files (x86)/Java/jre7"/> <!-- UPDATE THIS! -->
6767
<property name="java32.ubuntu.home" value="C:/RTC/WebGoat/ubuntu_openjava_6_32"/> <!-- UPDATE THIS! -->

‎pom.xml‎

Lines changed: 143 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<groupId>WebGoat</groupId>
55
<artifactId>WebGoat</artifactId>
66
<packaging>war</packaging>
7-
<version>5.4-SNAPSHOT</version>
7+
<version>6.0-SNAPSHOT</version>
88

99
<repositories>
1010
<repository>
@@ -13,7 +13,13 @@
1313
<url>http://download.java.net/maven/2</url>
1414
</repository>
1515
</repositories>
16-
16+
17+
<!-- Shared version number properties -->
18+
<properties>
19+
<org.springframework.version>3.0.5.RELEASE</org.springframework.version>
20+
<spring.security.version>3.1.2.RELEASE</spring.security.version>
21+
<tiles.version>2.2.2</tiles.version>
22+
</properties>
1723

1824
<build>
1925
<resources>
@@ -149,20 +155,147 @@
149155
<groupId>net.sourceforge.jtds</groupId>
150156
<artifactId>jtds</artifactId>
151157
<version>1.2.2</version>
152-
</dependency>
153-
154-
<dependency>
155-
<groupId>javax.servlet</groupId>
156-
<artifactId>servlet-api</artifactId>
157-
<version>2.3</version>
158-
<scope>provided</scope>
159-
</dependency>
158+
</dependency>
160159
<dependency>
161160
<groupId>org.apache.tomcat</groupId>
162161
<artifactId>tomcat-catalina</artifactId>
163162
<version>7.0.27</version>
164163
<scope>provided</scope>
165164
</dependency>
166165

166+
167+
<!-- ************* spring MVC and related dependencies ************** -->
168+
169+
<!-- servlet API -->
170+
<dependency>
171+
<groupId>javax</groupId>
172+
<artifactId>javaee-api</artifactId>
173+
<version>6.0</version>
174+
<scope>provided</scope>
175+
</dependency>
176+
177+
<dependency>
178+
<groupId>org.springframework</groupId>
179+
<artifactId>spring-core</artifactId>
180+
<version>${org.springframework.version}</version>
181+
</dependency>
182+
183+
<!-- Spring MVC framework -->
184+
<dependency>
185+
<groupId>org.springframework</groupId>
186+
<artifactId>spring-webmvc</artifactId>
187+
<version>${org.springframework.version}</version>
188+
<type>jar</type>
189+
</dependency>
190+
191+
<dependency>
192+
<groupId>org.springframework.security</groupId>
193+
<artifactId>spring-security-core</artifactId>
194+
<version>${spring.security.version}</version>
195+
</dependency>
196+
197+
<dependency>
198+
<groupId>org.springframework.security</groupId>
199+
<artifactId>spring-security-config</artifactId>
200+
<version>${spring.security.version}</version>
201+
</dependency>
202+
203+
<dependency>
204+
<groupId>org.springframework.security</groupId>
205+
<artifactId>spring-security-web</artifactId>
206+
<version>${spring.security.version}</version>
207+
</dependency>
208+
209+
<!-- Apache Commons Upload -->
210+
<dependency>
211+
<groupId>commons-fileupload</groupId>
212+
<artifactId>commons-fileupload</artifactId>
213+
<version>1.2.2</version>
214+
</dependency>
215+
216+
<!-- Apache Commons Upload -->
217+
<dependency>
218+
<groupId>commons-io</groupId>
219+
<artifactId>commons-io</artifactId>
220+
<version>1.3.2</version>
221+
</dependency>
222+
223+
<!-- JSTL -->
224+
<dependency>
225+
<groupId>javax.servlet</groupId>
226+
<artifactId>jstl</artifactId>
227+
<version>1.2</version>
228+
</dependency>
229+
230+
<dependency>
231+
<groupId>taglibs</groupId>
232+
<artifactId>standard</artifactId>
233+
<version>1.1.2</version>
234+
</dependency>
235+
236+
<dependency>
237+
<groupId>log4j</groupId>
238+
<artifactId>log4j</artifactId>
239+
<version>1.2.15</version>
240+
<exclusions>
241+
<exclusion>
242+
<groupId>javax.jms</groupId>
243+
<artifactId>jms</artifactId>
244+
</exclusion>
245+
<exclusion>
246+
<groupId>com.sun.jdmk</groupId>
247+
<artifactId>jmxtools</artifactId>
248+
</exclusion>
249+
<exclusion>
250+
<groupId>com.sun.jmx</groupId>
251+
<artifactId>jmxri</artifactId>
252+
</exclusion>
253+
</exclusions>
254+
</dependency>
255+
<dependency>
256+
<groupId>junit</groupId>
257+
<artifactId>junit</artifactId>
258+
<version>4.8.1</version>
259+
<type>jar</type>
260+
</dependency>
261+
<dependency>
262+
<groupId>org.apache.tiles</groupId>
263+
<artifactId>tiles-core</artifactId>
264+
<version>${tiles.version}</version>
265+
<type>jar</type>
266+
</dependency>
267+
<dependency>
268+
<groupId>org.apache.tiles</groupId>
269+
<artifactId>tiles-template</artifactId>
270+
<version>${tiles.version}</version>
271+
<type>jar</type>
272+
</dependency>
273+
<dependency>
274+
<groupId>org.apache.tiles</groupId>
275+
<artifactId>tiles-servlet</artifactId>
276+
<version>${tiles.version}</version>
277+
<type>jar</type>
278+
</dependency>
279+
<dependency>
280+
<groupId>org.apache.tiles</groupId>
281+
<artifactId>tiles-jsp</artifactId>
282+
<version>${tiles.version}</version>
283+
<type>jar</type>
284+
</dependency>
285+
<dependency>
286+
<groupId>org.slf4j</groupId>
287+
<artifactId>slf4j-api</artifactId>
288+
<version>1.5.8</version>
289+
<type>jar</type>
290+
</dependency>
291+
<dependency>
292+
<groupId>org.slf4j</groupId>
293+
<artifactId>slf4j-log4j12</artifactId>
294+
<version>1.5.8</version>
295+
<type>jar</type>
296+
</dependency>
297+
298+
<!-- ************* END spring MVC and related dependencies ************** -->
299+
167300
</dependencies>
168301
</project>

‎src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -561,6 +561,20 @@ public String getSolution(WebSession s)
561561
// Solutions are html files
562562
return src;
563563
}
564+
565+
566+
/**
567+
* <p>Returns the default "path" portion of a lesson's URL.</p>
568+
*
569+
* <p>Legacy webgoat lesson links are of the form "attack?Screen=Xmenu=Ystage=Z".
570+
* This method returns the path portion of the url, i.e., "attack" in the string above.</p>
571+
*
572+
* <p>Newer, Spring-Controller-based classes will override this method
573+
* to return "*.do"-styled paths.</p>
574+
*/
575+
protected String getPath() {
576+
return "attack";
577+
}
564578

565579
/**
566580
* Get the link that can be used to request this screen.
@@ -571,7 +585,8 @@ public String getLink()
571585
{
572586
StringBuffer link = new StringBuffer();
573587

574-
link.append("attack?");
588+
// mvc update:
589+
link.append(getPath()).append("?");
575590
link.append(WebSession.SCREEN);
576591
link.append("=");
577592
link.append(getScreenId());

‎src/main/java/org/owasp/webgoat/lessons/HttpBasicsController.java‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
package org.owasp.webgoat.lessons;
2+
3+
import java.util.ArrayList;
4+
import java.util.List;
5+
6+
import org.apache.log4j.Logger;
7+
import org.owasp.webgoat.lessons.model.HttpBasicsModel;
8+
import org.owasp.webgoat.session.WebSession;
9+
import org.springframework.stereotype.Controller;
10+
import org.springframework.ui.ModelMap;
11+
import org.springframework.web.bind.annotation.ModelAttribute;
12+
import org.springframework.web.bind.annotation.RequestMapping;
13+
import org.springframework.web.bind.annotation.RequestMethod;
14+
import org.springframework.web.servlet.ModelAndView;
15+
16+
/**
17+
* <p>
18+
* Handles the "HTTP Basics" lesson. Contains all
19+
* mapping methods for that lesson as well as all helper methods
20+
* used by those mappers.
21+
* </p>
22+
*
23+
*/
24+
@Controller
25+
public class HttpBasicsController extends LessonAdapter {
26+
27+
protected static Logger logger = Logger.getLogger("controller");
28+
29+
// [url] path used by this lesson
30+
private final String PAGE_PATH = "httpBasics.do";
31+
32+
// The (apache) tile used by this lesson, as specified in tiles-definitions.xml
33+
private String TILE_NAME = "http-basics";
34+
35+
// ID attribute associated with the JSP's form.
36+
private String FORM_NAME = "command";
37+
38+
39+
/**
40+
* @see {@link org.owasp.webgoat.lessons.AbstractLesson#getPath()}
41+
* @see {@link org.owasp.webgoat.lessons.AbstractLesson#getLink()}
42+
*/
43+
protected String getPath() {
44+
return PAGE_PATH;
45+
}
46+
47+
/**
48+
* Handles GET requests for this lesson.
49+
* @return
50+
*/
51+
@RequestMapping(value = PAGE_PATH, method = RequestMethod.GET)
52+
public ModelAndView displayPage() {
53+
return new ModelAndView(TILE_NAME, FORM_NAME, new HttpBasicsModel());
54+
}
55+
56+
/**
57+
* Handles POST requests for this lesson. Takes the user's name and displays
58+
* a reversed copy of it.
59+
*
60+
* @param httpBasicsModel
61+
* @param model
62+
* @return
63+
*/
64+
@RequestMapping(value = PAGE_PATH, method = RequestMethod.POST)
65+
public ModelAndView processSubmit(
66+
@ModelAttribute("")HttpBasicsModel httpBasicsModel, ModelMap model) {
67+
68+
StringBuffer personName = new StringBuffer(httpBasicsModel.getPersonName());
69+
httpBasicsModel.setPersonName(personName.reverse().toString());
70+
71+
return new ModelAndView(TILE_NAME, FORM_NAME, httpBasicsModel);
72+
}
73+
74+
75+
public Category getCategory()
76+
{
77+
return Category.GENERAL;
78+
}
79+
80+
/**
81+
* Gets the hints attribute of the HelloScreen object
82+
*
83+
* @return The hints value
84+
*/
85+
public List<String> getHints(WebSession s)
86+
{
87+
List<String> hints = new ArrayList<String>();
88+
hints.add("Type in your name and press 'go'");
89+
hints.add("Turn on Show Parameters or other features");
90+
hints.add("Try to intercept the request with WebScarab");
91+
hints.add("Press the Show Lesson Plan button to view a lesson summary");
92+
hints.add("Press the Show Solution button to view a lesson solution");
93+
94+
return hints;
95+
}
96+
97+
protected String getInstructions()
98+
{
99+
return null;
100+
}
101+
102+
public String getTitle()
103+
{
104+
// TODO: GET RID OF THE "(Spring MVC)" BELOW LATER!!!!"
105+
return "HTTP Basics (Spring MVC)";
106+
}
107+
}

‎src/main/java/org/owasp/webgoat/lessons/model/HttpBasicsModel.java‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
package org.owasp.webgoat.lessons.model;
2+
3+
/**
4+
* Model component for the Http Basics lesson. Using a model
5+
* for that simple lesson is architectural overkill. We do it anyway
6+
* for illustrative purposes - to demonstrate the pattern that we will
7+
* use for more complex lessons.
8+
*
9+
*/
10+
public class HttpBasicsModel {
11+
12+
private String personName;
13+
14+
public String getPersonName() {
15+
return personName;
16+
}
17+
18+
public void setPersonName(String personName) {
19+
this.personName = personName;
20+
}
21+
}

0 commit comments

Comments
 (0)