Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Check null dereference in DOMCrossSiteScripting #1

Open
wants to merge 19 commits into
base: master
Choose a base branch
from
Open

Check null dereference in DOMCrossSiteScripting #1

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
d9c42b8
Check null dereference in DOMCrossSiteScripting
kuanbs Jun 24, 2020
9509e48
Merge pull request #1 from kuanbs/muse_challenge
kuanbs Jun 24, 2020
817eb15
Revert "Check null dereference in DOMCrossSiteScripting"
kuanbs Jun 24, 2020
350acae
Merge pull request #2 from kuanbs/revert-1-muse_challenge
kuanbs Jun 24, 2020
c9ef0a9
Update DOMCrossSiteScripting.java
kuanbs Jun 24, 2020
0960d0b
Merge branch 'master' into muse_challenge
kuanbs Jun 24, 2020
2aba980
Merge pull request #3 from kuanbs/muse_challenge
kuanbs Jun 24, 2020
915dce2
Revert "Update DOMCrossSiteScripting.java"
kuanbs Jun 24, 2020
63338db
Merge pull request #4 from kuanbs/revert-3-muse_challenge
kuanbs Jun 24, 2020
bb78a27
Update WebSecurityConfig.java
kuanbs Jun 24, 2020
1df2371
Update WebSecurityConfig.java
kuanbs Jun 24, 2020
34d6eb8
Update DOMCrossSiteScripting.java
kuanbs Jun 25, 2020
9f6ee02
Update WebSecurityConfig.java
kuanbs Jun 25, 2020
f780ebd
Merge branch 'master' into muse_challenge
kuanbs Jun 25, 2020
96a8969
Update DOMCrossSiteScripting.java
kuanbs Jun 25, 2020
b391f7b
Update WebSecurityConfig.java (#5)
kuanbs Jun 25, 2020
835c168
Update StoredCrossSiteScriptingVerifier.java
kuanbs Jun 25, 2020
56b1c8c
Update WebSecurityConfig.java
kuanbs Jun 25, 2020
6a2b728
Merge branch 'master' into muse_challenge
kuanbs Jun 25, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions webgoat-container/src/main/java/org/owasp/webgoat/WebSecurityConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,6 @@ protected void configure(HttpSecurity http) throws Exception {
.permitAll();
security.and()
.logout().deleteCookies("JSESSIONID").invalidateHttpSession(true);
security.and().csrf().disable();

http.headers().cacheControl().disable();
http.exceptionHandling().authenticationEntryPoint(new AjaxAuthenticationEntryPoint("/login"));
Expand Down Expand Up @@ -97,4 +96,4 @@ protected AuthenticationManager authenticationManager() throws Exception {
public NoOpPasswordEncoder passwordEncoder() {
return (NoOpPasswordEncoder) NoOpPasswordEncoder.getInstance();
}
}
}
7 changes: 5 additions & 2 deletions ...ssons/cross-site-scripting/src/main/java/org/owasp/webgoat/xss/DOMCrossSiteScripting.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,12 +40,15 @@ public AttackResult completed(@RequestParam Integer param1,
UserSessionData userSessionData = getUserSessionData();
SecureRandom number = new SecureRandom();
userSessionData.setValue("randValue", String.valueOf(number.nextInt()));

if (param1 == 42 && param2 == 24 && request.getHeader("webgoat-requested-by").equals("dom-xss-vuln")) {
return success(this).output("phoneHome Response is " + userSessionData.getValue("randValue").toString()).build();
if (userSessionData != null && userSessionData.getValue("randValue") != null){
return success(this).output("phoneHome Response is " + userSessionData.getValue("randValue").toString()).build();
}
} else {
return failed(this).build();
}
Comment on lines 46 to 48
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Build complains here with: "missing return statement". I think this fixes it:

Suggested change
} else {
return failed(this).build();
}
}
return failed(this).build();


}
}
// something like ... http://localhost:8080/WebGoat/start.mvc#test/testParam=foobar&_someVar=234902384lotslsfjdOf9889080GarbageHere%3Cscript%3Ewebgoat.customjs.phoneHome();%3C%2Fscript%3E--andMoreGarbageHere
Expand Down