From 839ca96544acad71fde910a4cff7f7e491aeab11 Mon Sep 17 00:00:00 2001 From: Jason White Date: Wed, 25 Jan 2017 11:18:24 -0500 Subject: [PATCH 1/8] #315 Adding UI handling and corresponding expected elements for html files for decoration. Inlucdes minor refactor --- .../owasp/webgoat/lessons/AttackResult.java | 8 +- .../js/goatApp/controller/LessonController.js | 4 +- .../js/goatApp/view/LessonContentView.js | 17 +- .../js/goatApp/view/LessonProgressView.js | 2 +- .../html/CrossSiteScripting.html | 74 ++-- .../en/CrossSiteScripting_content5b.adoc | 4 + .../plugin/CSRF/html/{XXE.html => CSRF.html} | 3 + .../plugin/HttpBasics/html/HttpBasics.html | 5 +- .../main/resources/plugin/IDOR/html/IDOR.html | 195 ++++----- .../SqlInjection/html/SqlInjection.html | 412 +++++++++--------- .../main/resources/plugin/XXE/html/XXE.html | 4 + 11 files changed, 372 insertions(+), 356 deletions(-) create mode 100644 webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/lessonPlans/en/CrossSiteScripting_content5b.adoc rename webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/{XXE.html => CSRF.html} (96%) diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AttackResult.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AttackResult.java index dcd2204b59..ca42198495 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AttackResult.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AttackResult.java @@ -34,7 +34,7 @@ @Getter public class AttackResult { - private boolean lessonCompleted; + private boolean assignmentCompleted; private String feedback; private String output; @@ -48,7 +48,7 @@ public static AttackResult success(String feedback) { public static AttackResult success(String feedback, String output) { AttackResult attackResult = new AttackResult(); - attackResult.lessonCompleted = true; + attackResult.assignmentCompleted = true; attackResult.feedback = feedback; attackResult.output = output; return attackResult; @@ -60,13 +60,13 @@ public static AttackResult failed(String feedback) { public static AttackResult failed(String feedback, String output) { AttackResult attackResult = new AttackResult(); - attackResult.lessonCompleted = false; + attackResult.assignmentCompleted = false; attackResult.feedback = feedback; attackResult.output = output; return attackResult; } public boolean assignmentSolved() { - return lessonCompleted; + return assignmentCompleted; } } diff --git a/webgoat-container/src/main/resources/static/js/goatApp/controller/LessonController.js b/webgoat-container/src/main/resources/static/js/goatApp/controller/LessonController.js index 6ce9932b15..a4b93ff180 100644 --- a/webgoat-container/src/main/resources/static/js/goatApp/controller/LessonController.js +++ b/webgoat-container/src/main/resources/static/js/goatApp/controller/LessonController.js @@ -64,8 +64,8 @@ define(['jquery', this.listenTo(this.lessonContent,'content:loaded',this.onContentLoaded); this.userAndInfoView = new UserAndInfoView(); this.menuButtonView = new MenuButtonView(); - this.listenTo(this.lessonContentView, 'lesson:complete', this.updateMenu); - this.listenTo(this.lessonContentView, 'lesson:complete', this.updateLessonOverview); + this.listenTo(this.lessonContentView, 'assignment:complete', this.updateMenu); + this.listenTo(this.lessonContentView, 'assignment:complete', this.updateLessonOverview); }; this.loadLesson = function(name,pageNum) { diff --git a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js index 7f0ce6794e..1c51bcfd12 100644 --- a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js +++ b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js @@ -114,13 +114,24 @@ define(['jquery', this.renderFeedback(data.feedback); this.renderOutput(data.output || ""); - if (data.lessonCompleted) { - this.curForm.reset(); - this.trigger('lesson:complete'); + if (data.assignmentCompleted) { + this.markAssignmentComplete(); + this.trigger('assignment:complete'); + } else { + this.markAssignmentIncomplete(); } return false; }, + markAssignmentComplete: function () { + this.curForm.reset(); + $(this.curForm).siblings('.assignment-success').find('i').removeClass('hidden'); + }, + + markAssignmentIncomplete: function () { + $(this.curForm).siblings('.assignment-success').find('i').addClass('hidden'); + }, + onErrorResponse: function (a,b,c) { console.error(a); console.error(b); diff --git a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonProgressView.js b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonProgressView.js index 0c3e892b13..a3b05729de 100644 --- a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonProgressView.js +++ b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonProgressView.js @@ -16,7 +16,7 @@ define(['jquery', } }, render: function () { - if (this.model.get("lessonCompleted")) { + if (this.model.get("assignmentCompleted")) { this.$el.html(this.model.get('successMessage')); } else { this.$el.html(""); diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/html/CrossSiteScripting.html b/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/html/CrossSiteScripting.html index 1e1001411c..4872350dc5 100644 --- a/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/html/CrossSiteScripting.html +++ b/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/html/CrossSiteScripting.html @@ -174,8 +174,8 @@

Shopping Cart

which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+
-
@@ -193,7 +193,6 @@

Shopping Cart

-
@@ -228,42 +227,43 @@

Shopping Cart

+
-
- - - -
- - - - - - - - - - - - -
Title:
Message:
-

- -

-
-
-

Message List

- - - - - - -
-
-
+ + + + +
+ + + + + + + + + + + + +
Title:
Message:
+

+ +

+
+
+

Message List

+ + + + + + +
+
+
diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/lessonPlans/en/CrossSiteScripting_content5b.adoc b/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/lessonPlans/en/CrossSiteScripting_content5b.adoc new file mode 100644 index 0000000000..f4e3b0570b --- /dev/null +++ b/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/lessonPlans/en/CrossSiteScripting_content5b.adoc @@ -0,0 +1,4 @@ +== Was it Really Reflected XSS? + +Now, was the last attack truly reflected XSS? + diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/XXE.html b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/CSRF.html similarity index 96% rename from webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/XXE.html rename to webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/CSRF.html index e106526831..c2bb6e238c 100644 --- a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/XXE.html +++ b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/CSRF.html @@ -20,6 +20,7 @@
+
@@ -69,6 +70,7 @@ which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+
@@ -128,6 +130,7 @@ which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+
diff --git a/webgoat-lessons/http-basics/src/main/resources/plugin/HttpBasics/html/HttpBasics.html b/webgoat-lessons/http-basics/src/main/resources/plugin/HttpBasics/html/HttpBasics.html index 157cc58510..30832a2797 100644 --- a/webgoat-lessons/http-basics/src/main/resources/plugin/HttpBasics/html/HttpBasics.html +++ b/webgoat-lessons/http-basics/src/main/resources/plugin/HttpBasics/html/HttpBasics.html @@ -15,6 +15,7 @@
+
@@ -44,8 +45,8 @@ which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+
-
@@ -81,8 +82,6 @@
-
-
diff --git a/webgoat-lessons/idor/src/main/resources/plugin/IDOR/html/IDOR.html b/webgoat-lessons/idor/src/main/resources/plugin/IDOR/html/IDOR.html index 0796396bc3..b5a6473432 100644 --- a/webgoat-lessons/idor/src/main/resources/plugin/IDOR/html/IDOR.html +++ b/webgoat-lessons/idor/src/main/resources/plugin/IDOR/html/IDOR.html @@ -13,30 +13,29 @@ which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+
-
- - - - - -
- - - - - - - -
user/passuser:pass: - -
-
-
+ + + + + +
+ + + + + + + +
user/passuser:pass: + +
+
@@ -50,23 +49,22 @@ which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+
-
- - - - - -
-