Selenium test added (WebGoat#906)

* add a selenium test for firefox * add geckodriver and firefox to travis * install updated * install updated * try out suggested webdriver dependency class * add more resilience
GLJones · Feb 21, 2021 · 431da30 · 431da30
1 parent ad5ab4c
commit 431da30
Show file tree

Hide file tree

Showing 4 changed files with 144 additions and 19 deletions.
diff --git a/.travis.yml b/.travis.yml
@@ -8,7 +8,10 @@ dist: xenial
 jdk:
   - openjdk11
   - openjdk15
-install: true
+addons:
+  firefox: latest
+install:  
+  - true
 script:
   - export BRANCH=$(if [ "$TRAVIS_PULL_REQUEST" == "false" ]; then echo $TRAVIS_BRANCH;
     else echo $TRAVIS_PULL_REQUEST_BRANCH; fi)

diff --git a/webgoat-integration-tests/pom.xml b/webgoat-integration-tests/pom.xml
@@ -10,6 +10,17 @@
     </parent>
 
     <dependencies>
+    	<dependency>
+            <groupId>org.seleniumhq.selenium</groupId>
+	    <artifactId>selenium-java</artifactId>
+	    <scope>test</scope>
+	</dependency>
+	<dependency>
+    	<groupId>io.github.bonigarcia</groupId>
+    	<artifactId>webdrivermanager</artifactId>
+    	<version>4.2.2</version>
+    	<scope>test</scope>
+	</dependency>
         <dependency>
             <groupId>org.owasp.webgoat</groupId>
             <artifactId>webgoat-server</artifactId>

diff --git a/webgoat-integration-tests/src/test/java/org/owasp/webgoat/SeleniumTest.java b/webgoat-integration-tests/src/test/java/org/owasp/webgoat/SeleniumTest.java
@@ -0,0 +1,111 @@
+package org.owasp.webgoat;
+
+import java.util.concurrent.TimeUnit;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.openqa.selenium.By;
+import org.openqa.selenium.WebDriver;
+import org.openqa.selenium.firefox.FirefoxBinary;
+import org.openqa.selenium.firefox.FirefoxDriver;
+import org.openqa.selenium.firefox.FirefoxOptions;
+
+import io.github.bonigarcia.wdm.WebDriverManager;
+import io.github.bonigarcia.wdm.config.DriverManagerType;
+
+public class SeleniumTest extends IntegrationTest {
+
+	static {
+		try {
+			WebDriverManager.getInstance(DriverManagerType.FIREFOX).setup();
+		} catch (Exception e) {
+			//sometimes a 403 cause an ExceptionInInitializerError
+		}
+	}
+	private WebDriver driver;
+
+	@BeforeEach
+	public void setUpAndLogin() {
+		try {
+			FirefoxBinary firefoxBinary = new FirefoxBinary();
+			firefoxBinary.addCommandLineOptions("--headless");
+
+			FirefoxOptions firefoxOptions = new FirefoxOptions();
+			firefoxOptions.setBinary(firefoxBinary);
+			driver = new FirefoxDriver(firefoxOptions);
+			driver.get(url("/login"));
+			driver.manage().timeouts().implicitlyWait(30, TimeUnit.SECONDS);
+			// Login
+			driver.findElement(By.name("username")).sendKeys(getWebgoatUser());
+			driver.findElement(By.name("password")).sendKeys("password");
+			driver.findElement(By.className("btn")).click();
+
+			// Check if user exists. If not, create user.
+			if (driver.getCurrentUrl().equals(url("/login?error"))) {
+				driver.get(url("/registration"));
+				driver.findElement(By.id("username")).sendKeys(getWebgoatUser());
+				driver.findElement(By.id("password")).sendKeys("password");
+				driver.findElement(By.id("matchingPassword")).sendKeys("password");
+				driver.findElement(By.name("agree")).click();
+				driver.findElement(By.className("btn-primary")).click();
+			}
+		} catch (IllegalStateException e) {
+			System.err.println("Web driver not found here: "+System.getProperty("webdriver.gecko.driver"));
+		}
+
+	}
+
+	@AfterEach
+	public void tearDown() {
+		if (null != driver) {
+			driver.close();
+		}
+	}
+
+	@Test
+	public void sqlInjection() {
+
+		if (null==driver) return;
+
+		driver.get(url("/start.mvc#lesson/SqlInjection.lesson"));
+		driver.get(url("/start.mvc#lesson/SqlInjection.lesson/1"));
+		driver.findElement(By.id("restart-lesson-button")).click();
+		driver.get(url("/start.mvc#lesson/SqlInjection.lesson/0"));
+		driver.get(url("/start.mvc#lesson/SqlInjection.lesson/1"));
+		driver.findElement(By.name("query")).sendKeys(SqlInjectionLessonTest.sql_2);
+		driver.findElement(By.name("query")).submit();
+
+		driver.get(url("/start.mvc#lesson/SqlInjection.lesson/2"));
+		driver.findElements(By.name("query")).get(1).sendKeys(SqlInjectionLessonTest.sql_3);
+		driver.findElements(By.name("query")).get(1).submit();
+
+		driver.get(url("/start.mvc#lesson/SqlInjection.lesson/3"));
+		driver.findElements(By.name("query")).get(2).sendKeys(SqlInjectionLessonTest.sql_4_drop);
+		driver.findElements(By.name("query")).get(2).submit();
+
+		driver.get(url("/start.mvc#lesson/SqlInjection.lesson/3"));
+		driver.findElements(By.name("query")).get(2).clear();
+		driver.findElements(By.name("query")).get(2).sendKeys(SqlInjectionLessonTest.sql_4_add);
+		driver.findElements(By.name("query")).get(2).submit();
+		driver.findElements(By.name("query")).get(2).clear();
+		driver.findElements(By.name("query")).get(2).sendKeys(SqlInjectionLessonTest.sql_4_drop);
+		driver.findElements(By.name("query")).get(2).submit();
+
+		driver.get(url("/start.mvc#lesson/SqlInjection.lesson/4"));
+		driver.findElements(By.name("query")).get(3).sendKeys(SqlInjectionLessonTest.sql_5);
+		driver.findElements(By.name("query")).get(3).submit();
+
+		driver.get(url("/start.mvc#lesson/SqlInjection.lesson/8"));
+		driver.findElement(By.name("account")).sendKeys("Smith'");
+		driver.findElement(By.name("operator")).sendKeys("OR");
+		driver.findElement(By.name("injection")).sendKeys("'1'='1");
+		driver.findElement(By.name("Get Account Info")).click();
+
+		driver.get(url("/start.mvc#lesson/SqlInjection.lesson/9"));
+		driver.findElement(By.name("userid")).sendKeys(SqlInjectionLessonTest.sql_10_userid);
+		driver.findElement(By.name("login_count")).sendKeys(SqlInjectionLessonTest.sql_10_login_count);
+		driver.findElements(By.name("Get Account Info")).get(1).click();
+	}
+
+}
diff --git a/webgoat-integration-tests/src/test/java/org/owasp/webgoat/SqlInjectionLessonTest.java b/webgoat-integration-tests/src/test/java/org/owasp/webgoat/SqlInjectionLessonTest.java
@@ -7,24 +7,24 @@
 
 public class SqlInjectionLessonTest extends IntegrationTest {
 
-    private static final String sql_2 = "select department from employees where last_name='Franco'";
-    private static final String sql_3 = "update employees set department='Sales' where last_name='Barnett'";
-    private static final String sql_4_drop = "alter table employees drop column phone";
-    private static final String sql_4_add = "alter table employees add column phone varchar(20)";
-    private static final String sql_5 = "grant alter table to UnauthorizedUser";
-    private static final String sql_9_account = " ' ";
-    private static final String sql_9_operator = "or";
-    private static final String sql_9_injection = "'1'='1";
-    private static final String sql_10_login_count = "2";
-    private static final String sql_10_userid = "1 or 1=1";
-
-    private static final String sql_11_a = "Smith' or '1' = '1";
-    private static final String sql_11_b = "3SL99A'  or '1'='1";
-
-    private static final String sql_12_a = "Smith";
-    private static final String sql_12_b = "3SL99A' ; update employees set salary= '100000' where last_name='Smith";
-
-    private static final String sql_13 = "%update% '; drop table access_log ; --'";
+    public static final String sql_2 = "select department from employees where last_name='Franco'";
+    public static final String sql_3 = "update employees set department='Sales' where last_name='Barnett'";
+    public static final String sql_4_drop = "alter table employees drop column phone";
+    public static final String sql_4_add = "alter table employees add column phone varchar(20)";
+    public static final String sql_5 = "grant alter table to UnauthorizedUser";
+    public static final String sql_9_account = " ' ";
+    public static final String sql_9_operator = "or";
+    public static final String sql_9_injection = "'1'='1";
+    public static final String sql_10_login_count = "2";
+    public static final String sql_10_userid = "1 or 1=1";
+
+    public static final String sql_11_a = "Smith' or '1' = '1";
+    public static final String sql_11_b = "3SL99A'  or '1'='1";
+
+    public static final String sql_12_a = "Smith";
+    public static final String sql_12_b = "3SL99A' ; update employees set salary= '100000' where last_name='Smith";
+
+    public static final String sql_13 = "%update% '; drop table access_log ; --'";
 
     @Test
     public void runTests() {