Fix

qpioneer · Sep 20, 2019 · c8ef848 · c8ef848
1 parent f29b923
commit c8ef848
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 21 deletions.
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Assignment.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Assignment.java
@@ -57,6 +57,9 @@ public Assignment(String name) {
     }
 
     public Assignment(String name, String path, List<String> hints) {
+        if (path.equals("")) {
+            System.out.println(name);
+        }
         this.name = name;
         this.path = path;
         this.hints = hints;

diff --git a/...http-proxies/src/main/java/org/owasp/webgoat/http_proxies/HttpBasicsInterceptRequest.java b/...http-proxies/src/main/java/org/owasp/webgoat/http_proxies/HttpBasicsInterceptRequest.java
@@ -25,31 +25,32 @@
 import org.owasp.webgoat.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.assignments.AssignmentPath;
 import org.owasp.webgoat.assignments.AttackResult;
+import org.springframework.http.HttpMethod;
 import org.springframework.web.bind.MissingServletRequestParameterException;
 import org.springframework.web.bind.annotation.*;
 
+import javax.servlet.http.HttpServletRequest;
+
 @RestController
 public class HttpBasicsInterceptRequest extends AssignmentEndpoint {
 
-//    @ExceptionHandler(MissingServletRequestParameterException.class)
-//    public AttackResult handleMissingParams() {
-//        return trackProgress(failed().feedback("http-proxies.intercept.failure").build());
-//    }
-
-    @GetMapping("/HttpProxies/intercept-request")
+    @RequestMapping(path = "/HttpProxies/intercept-request", method = {RequestMethod.POST, RequestMethod.GET})
     @ResponseBody
     public AttackResult completed(@RequestHeader(value = "x-request-intercepted", required = false) Boolean headerValue,
-                                  @RequestParam(value = "changeMe", required = false) String paramValue) {
+                                  @RequestParam(value = "changeMe", required = false) String paramValue, HttpServletRequest request) {
+        if (HttpMethod.POST.matches(request.getMethod())) {
+            return trackProgress(failed().feedback("http-proxies.intercept.failure").build());
+        }
         if (headerValue != null && paramValue != null && headerValue && "Requests are tampered easily".equalsIgnoreCase(paramValue)) {
             return trackProgress(success().feedback("http-proxies.intercept.success").build());
         } else {
             return trackProgress(failed().feedback("http-proxies.intercept.failure").build());
         }
     }
 
-//    @PostMapping("/HttpProxies/intercept-request")
-//    @ResponseBody
-//    public AttackResult post() {
-//        return trackProgress(failed().feedback("http-proxies.intercept.failure").build());
-//    }
+    @ExceptionHandler(MissingServletRequestParameterException.class)
+    public AttackResult handleMissingParams() {
+        return trackProgress(failed().feedback("http-proxies.intercept.failure").build());
+    }
+
 }
diff --git a/...-proxies/src/test/java/org/owasp/webgoat/http_proxies/HttpBasicsInterceptRequestTest.java b/...-proxies/src/test/java/org/owasp/webgoat/http_proxies/HttpBasicsInterceptRequestTest.java
@@ -88,13 +88,13 @@ public void missingHeader() throws Exception {
                 .andExpect(jsonPath("$.lessonCompleted", CoreMatchers.is(false)));
     }
 
-//    @Test
-//    public void whenPostAssignmentShouldNotPass() throws Exception {
-//        mockMvc.perform(MockMvcRequestBuilders.post("/HttpProxies/intercept-request")
-//                .header("x-request-intercepted", "true")
-//                .param("changeMe", "Requests are tampered easily"))
-//                .andExpect(status().isOk())
-//                .andExpect(jsonPath("$.feedback", CoreMatchers.is(messages.getMessage("http-proxies.intercept.failure"))))
-//                .andExpect(jsonPath("$.lessonCompleted", CoreMatchers.is(false)));
-//    }
+    @Test
+    public void whenPostAssignmentShouldNotPass() throws Exception {
+        mockMvc.perform(MockMvcRequestBuilders.post("/HttpProxies/intercept-request")
+                .header("x-request-intercepted", "true")
+                .param("changeMe", "Requests are tampered easily"))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.feedback", CoreMatchers.is(messages.getMessage("http-proxies.intercept.failure"))))
+                .andExpect(jsonPath("$.lessonCompleted", CoreMatchers.is(false)));
+    }
 }