Skip to content

Commit

Permalink
progress fix for SqlInjectionMitigations
Browse files Browse the repository at this point in the history
  • Loading branch information
@zubcevic
zubcevic committed Jul 22, 2019
1 parent ea38973 commit b65644e
Show file tree
Hide file tree
Showing 6 changed files with 18 additions and 18 deletions.
2 changes: 1 addition & 1 deletion webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/Servers.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
* @since 6/13/17.
*/
@RestController
@RequestMapping("SqlInjection/servers")
@RequestMapping("SqlInjectionMitigations/servers")
public class Servers {

@AllArgsConstructor
Expand Down
2 changes: 1 addition & 1 deletion ...ql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10a.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;

@AssignmentPath("SqlInjection/attack10a")
@AssignmentPath("SqlInjectionMitigations/attack10a")
@Slf4j
@AssignmentHints(value = {"SqlStringInjectionHint-mitigation-10a-1", "SqlStringInjectionHint-mitigation-10a-10a2"})
public class SqlInjectionLesson10a extends AssignmentEndpoint {
Expand Down
2 changes: 1 addition & 1 deletion ...ql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
import java.util.regex.Matcher;
import java.util.regex.Pattern;

@AssignmentPath("SqlInjection/attack10b")
@AssignmentPath("SqlInjectionMitigations/attack10b")
@AssignmentHints(value = {"SqlStringInjectionHint-mitigation-10b-1", "SqlStringInjectionHint-mitigation-10b-2", "SqlStringInjectionHint-mitigation-10b-3", "SqlStringInjectionHint-mitigation-10b-4", "SqlStringInjectionHint-mitigation-10b-5"})
public class SqlInjectionLesson10b extends AssignmentEndpoint {

Expand Down
2 changes: 1 addition & 1 deletion ...ql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
* @author nbaars
* @since 6/13/17.
*/
@AssignmentPath("SqlInjection/attack12a")
@AssignmentPath("SqlInjectionMitigations/attack12a")
@AssignmentHints(value = {"SqlStringInjectionHint-mitigation-12a-1", "SqlStringInjectionHint-mitigation-12a-2", "SqlStringInjectionHint-mitigation-12a-3", "SqlStringInjectionHint-mitigation-12a-4"})
@Slf4j
public class SqlInjectionLesson12a extends AssignmentEndpoint {
Expand Down
6 changes: 3 additions & 3 deletions webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
<div class="adoc-content" th:replace="doc:SqlInjection_jdbc_completion.adoc"></div>
<div class="attack-container">
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
<form class="attack-form" accept-charset="UNKNOWN" method="POST" name="form" action="/WebGoat/SqlInjection/attack10a" enctype="application/json;charset=UTF-8">
<form class="attack-form" accept-charset="UNKNOWN" method="POST" name="form" action="/WebGoat/SqlInjectionMitigations/attack10a" enctype="application/json;charset=UTF-8">
<div>
<p>Connection conn = DriverManager.<input type="text" name="field1" id="field1" />(DBURL, DBUSER, DBPW);</p>
<p><input type="text" name="field2" id="field2" /> = conn.<input type="text" name="field3" id="field3" />("SELECT status FROM users WHERE name=<input type="text" name="field4" id="field4" /> AND mail=<input type="text" name="field5" id="field5" />");</p>
Expand All @@ -42,7 +42,7 @@
<div class="lesson-page-wrapper">
<div class="adoc-content" th:replace="doc:SqlInjection_jdbc_newcode.adoc"></div>
<div class="attack-container" style="border: none !important; height: 100%; min-height: 300px;">
<form id="codesubmit" style="height: 100%; min-height: 300px;" class="attack-form" accept-charset="UNKNOWN" method="POST" name="form" action="/WebGoat/SqlInjection/attack10b" enctype="application/json;charset=UTF-8">
<form id="codesubmit" style="height: 100%; min-height: 300px;" class="attack-form" accept-charset="UNKNOWN" method="POST" name="form" action="/WebGoat/SqlInjectionMitigations/attack10b" enctype="application/json;charset=UTF-8">
<div>
<div id="editor" style="position: absolute; top: 0; right: 0; bottom: 0; left: 0; height: 300px;" name="editor"></div>
<script th:src="@{/js/libs/ace/src-noconflict/ace.js}" type="text/javascript" charset="utf-8"></script>
Expand Down Expand Up @@ -78,7 +78,7 @@
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
<form class="attack-form" accept-charset="UNKNOWN"
method="POST" name="form"
action="/WebGoat/SqlInjection/attack12a"
action="/WebGoat/SqlInjectionMitigations/attack12a"
enctype="application/json;charset=UTF-8">
<div class="container-fluid">
<div class="row">
Expand Down
22 changes: 11 additions & 11 deletions ...njection/src/test/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12aTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,49 +38,49 @@ public void setup() {

@Test
public void knownAccountShouldDisplayData() throws Exception {
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers")
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers")
.param("column", "id"))

.andExpect(status().isOk());
}

@Test
public void addressCorrectShouldOrderByHostname() throws Exception {
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers")
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers")
.param("column", "CASE WHEN (SELECT ip FROM servers WHERE hostname='webgoat-prd') LIKE '104.%' THEN hostname ELSE id END"))

.andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-acc")));
}

@Test
public void addressCorrectShouldOrderByHostnameUsingSubstr() throws Exception {
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers")
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers")
.param("column", "case when (select ip from servers where hostname='webgoat-prd' and substr(ip,1,1) = '1') IS NOT NULL then hostname else id end"))

.andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-acc")));

mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers")
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers")
.param("column", "case when (select ip from servers where hostname='webgoat-prd' and substr(ip,2,1) = '0') IS NOT NULL then hostname else id end"))

.andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-acc")));

mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers")
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers")
.param("column", "case when (select ip from servers where hostname='webgoat-prd' and substr(ip,3,1) = '4') IS NOT NULL then hostname else id end"))

.andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-acc")));
}

@Test
public void addressIncorrectShouldOrderByIdUsingSubstr() throws Exception {
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers")
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers")
.param("column", "case when (select ip from servers where hostname='webgoat-prd' and substr(ip,1,1) = '9') IS NOT NULL then hostname else id end"))

.andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-dev")));
}

@Test
public void trueShouldSortByHostname() throws Exception {
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers")
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers")
.param("column", "(case when (true) then hostname else id end)"))

.andExpect(status().isOk())
Expand All @@ -89,7 +89,7 @@ public void trueShouldSortByHostname() throws Exception {

@Test
public void falseShouldSortById() throws Exception {
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers")
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers")
.param("column", "(case when (true) then hostname else id end)"))

.andExpect(status().isOk())
Expand All @@ -98,23 +98,23 @@ public void falseShouldSortById() throws Exception {

@Test
public void addressIncorrectShouldOrderByHostname() throws Exception {
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers")
mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers")
.param("column", "CASE WHEN (SELECT ip FROM servers WHERE hostname='webgoat-prd') LIKE '192.%' THEN hostname ELSE id END"))

.andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-dev")));
}

@Test
public void postingCorrectAnswerShouldPassTheLesson() throws Exception {
mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack12a")
mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjectionMitigations/attack12a")
.param("ip", "104.130.219.202"))

.andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(true)));
}

@Test
public void postingWrongAnswerShouldNotPassTheLesson() throws Exception {
mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack12a")
mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjectionMitigations/attack12a")
.param("ip", "192.168.219.202"))

.andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false)));
Expand Down

0 comments on commit b65644e

Please sign in to comment.