Exemplo n.º 1
0
 /**
  * This method validates input and then attempts to update the cheat sheet for the specified
  * module
  *
  * @param newSolution The new solution to store as a cheat sheet
  * @param moduleId[] The identifier of the module to update.
  * @param csrfToken
  */
 public void doPost(HttpServletRequest request, HttpServletResponse response)
     throws ServletException, IOException {
   // Setting IpAddress To Log and taking header for original IP if forwarded from proxy
   ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"));
   log.debug("*** servlets.Admin.CreateCheat ***");
   Encoder encoder = ESAPI.encoder();
   PrintWriter out = response.getWriter();
   out.print(getServletInfo());
   HttpSession ses = request.getSession(true);
   Cookie tokenCookie = Validate.getToken(request.getCookies());
   Object tokenParmeter = request.getParameter("csrfToken");
   if (Validate.validateAdminSession(ses, tokenCookie, tokenParmeter)) {
     ShepherdLogManager.setRequestIp(
         request.getRemoteAddr(),
         request.getHeader("X-Forwarded-For"),
         ses.getAttribute("userName").toString());
     log.debug("Current User: "******"userName").toString());
     if (Validate.validateTokens(tokenCookie, tokenParmeter)) {
       String errorMessage = null;
       String newSolution = request.getParameter("newSolution");
       log.debug("User submitted new solution - " + newSolution);
       String moduleId = request.getParameter("moduleId[]");
       log.debug("User submitted moduleId: " + moduleId);
       if (newSolution != null && !newSolution.isEmpty()) {
         String ApplicationRoot = getServletContext().getRealPath("");
         String moduleCheck = Getter.getModuleResult(ApplicationRoot, moduleId);
         if (moduleCheck != null) {
           if (!Setter.updateCheatSheet(
               ApplicationRoot, moduleId, encoder.encodeForHTML(newSolution)))
             errorMessage = "A database level error occurred. Please contact your administrator";
         } else {
           errorMessage = "Invalid Module submitted";
         }
       } else {
         errorMessage = "Invalid Module submitted";
       }
       String output = new String();
       if (errorMessage != null) {
         output =
             "<h2 class='title'>Create Cheat Sheet Failure</h2>"
                 + "<p>"
                 + encoder.encodeForHTML(errorMessage)
                 + "</p>";
       } else {
         output =
             "<h2 class='title'>Create Cheat Sheet Success</h2>"
                 + "<p>Cheat Sheet successfully created</p>";
       }
       out.write(output);
     }
   } else {
     out.write("<img src='css/images/loggedOutSheep.jpg'/>");
   }
   log.debug("*** END servlets.Admin.CreateCheat ***");
 }
  /**
   * Cross Site Request Forgery safe Reflected XSS vulnerability. cannot be remotely exploited, and
   * there fore only is executable against the person initiating the function.
   *
   * @param searchTerm To be spat back out at the user after been encoded for wrong HTML Context
   */
  public void doPost(HttpServletRequest request, HttpServletResponse response)
      throws ServletException, IOException {
    // Setting IpAddress To Log and taking header for original IP if forwarded from proxy
    ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"));
    log.debug("Cross-Site Scripting Challenge Four Servlet");
    PrintWriter out = response.getWriter();
    out.print(getServletInfo());

    // Translation Stuff
    Locale locale = new Locale(Validate.validateLanguage(request.getSession()));
    ResourceBundle errors = ResourceBundle.getBundle("i18n.servlets.errors", locale);
    ResourceBundle bundle = ResourceBundle.getBundle("i18n.servlets.challenges.xss.xss4", locale);

    try {
      HttpSession ses = request.getSession(true);
      if (Validate.validateSession(ses)) {
        ShepherdLogManager.setRequestIp(
            request.getRemoteAddr(),
            request.getHeader("X-Forwarded-For"),
            ses.getAttribute("userName").toString());
        log.debug(levelName + " servlet accessed by: " + ses.getAttribute("userName").toString());
        Cookie tokenCookie = Validate.getToken(request.getCookies());
        Object tokenParmeter = request.getParameter("csrfToken");
        if (Validate.validateTokens(tokenCookie, tokenParmeter)) {
          String htmlOutput = new String();
          String userPost = new String();
          String searchTerm = request.getParameter("searchTerm");
          log.debug("User Submitted - " + searchTerm);
          if (!searchTerm.startsWith("http")) {
            searchTerm = "https://www.owasp.org/index.php/OWASP_Security_Shepherd";
            userPost =
                "<a href=\""
                    + searchTerm
                    + "\" alt=\"OWASP Security Shepherd\">"
                    + searchTerm
                    + "</a>";
          } else {

            searchTerm = XssFilter.encodeForHtml(searchTerm);
            userPost =
                "<a href=\"" + searchTerm + "\" alt=\"" + searchTerm + "\">" + searchTerm + "</a>";
            log.debug("After Encoding - " + searchTerm);
            if (FindXSS.search(userPost)) {
              htmlOutput =
                  "<h2 class='title'>"
                      + bundle.getString("result.wellDone")
                      + "</h2>"
                      + "<p>"
                      + bundle.getString("result.youDidIt")
                      + "<br />"
                      + bundle.getString("result.resultKey")
                      + " <a>"
                      + Hash.generateUserSolution(
                          Getter.getModuleResultFromHash(
                              getServletContext().getRealPath(""), levelHash),
                          (String) ses.getAttribute("userName"))
                      + "</a>";
            }
          }
          log.debug("Adding searchTerm to Html: " + searchTerm);
          htmlOutput +=
              "<h2 class='title'>"
                  + bundle.getString("response.yourPost")
                  + "</h2>"
                  + "<p>"
                  + bundle.getString("response.linkPosted")
                  + "</p> "
                  + userPost
                  + "</p>";
          out.write(htmlOutput);
        }
      } else {
        log.error(levelName + " servlet was accessed without a valid session");
        out.write(errors.getString("error.noSession"));
      }
    } catch (Exception e) {
      out.write(errors.getString("error.funky"));
      log.fatal("Cross Site Scripting Challenge 4 - " + e.toString());
    }
  }
  public void doPost(HttpServletRequest request, HttpServletResponse response)
      throws ServletException, IOException {
    // Setting IpAddress To Log and taking header for original IP if forwarded from proxy
    ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"));
    log.debug("&&& servlets.module.SolutionSubmit &&&");
    PrintWriter out = response.getWriter();
    out.print(getServletInfo());
    HttpSession ses = request.getSession(true);
    if (Validate.validateSession(ses)) {
      ShepherdLogManager.setRequestIp(
          request.getRemoteAddr(),
          request.getHeader("X-Forwarded-For"),
          ses.getAttribute("userName").toString());
      log.debug("Current User: "******"userName").toString());
      Cookie tokenCookie = Validate.getToken(request.getCookies());
      Object tokenParmeter = request.getParameter("csrfToken");
      if (Validate.validateTokens(tokenCookie, tokenParmeter)) {
        boolean notNull = false;
        String storedResult = null;
        try {
          log.debug("Getting ApplicationRoot");
          String ApplicationRoot = getServletContext().getRealPath("");
          log.debug("Servlet root = " + ApplicationRoot);

          log.debug("Getting Parameters");
          String moduleId = (String) request.getParameter("moduleId");
          ;
          log.debug("moduleId = " + moduleId.toString());
          String solutionKey = (String) request.getParameter("solutionKey");
          ;
          log.debug("solutionKey = " + solutionKey.toString());

          log.debug("Getting session parameters");
          String userId = (String) ses.getAttribute("userStamp");
          String userName = (String) ses.getAttribute("userName");
          log.debug("userId = " + userId);

          // Validation
          notNull = (moduleId != null && solutionKey != null);
          if (notNull) {
            storedResult = Getter.getModuleResult(ApplicationRoot, moduleId);
          }
          if (notNull && storedResult != null) {
            boolean validKey = false;
            // Identify if solution is a user Specific key (Does it need to be decrypted?)
            if (Getter.getModuleKeyType(ApplicationRoot, moduleId))
              validKey = storedResult.compareTo(solutionKey) == 0;
            else {
              String decryptedKey = new String();
              try {
                // Encrypted Solution key,  must be decrypted before compare
                decryptedKey =
                    Hash.decryptUserSpecificSolution(
                        Validate.validateEncryptionKey(userName), solutionKey);
              } catch (Exception e) {
                log.error("Could not decrypt result key: " + e.toString());
                // Key likely could not be decrypted because somebody submitted a string that could
                // not be decrypted.
                // This is a bad submission so they should be warned. String will continue from this
                // point as an empty value and will cause the function to run the Bad Submission
                // procedure
              }
              storedResult +=
                  Hash.getCurrentSalt(); // Add server solution salt to base key before compare with
              // decrypted key
              validKey = storedResult.compareTo(decryptedKey) == 0;
              log.debug("Decrypted Submitted Key: " + decryptedKey);
              log.debug("Stored Expected Key    : " + storedResult);
            }
            if (validKey) {
              log.debug("Correct key submitted, checking that module not already completed");
              String result = Getter.checkPlayerResult(ApplicationRoot, moduleId, userId);
              if (result != null) {
                // If Feedback is enabled, the user must complete another step. This step is
                // continued in FeedbackSubmit.java
                if (FeedbackStatus.isEnabled()) {
                  log.debug("Returning Feedback Form for module: " + result);
                  out.write(
                      "<h2 class=\"title\">Solution Submission Success</h2><br>"
                          + "<p> You are one step away from completing <a>"
                          + encoder.encodeForHTML(result)
                          + "</a>! To complete the level please submit your feedback!"
                          + "</p><br/>"
                          + generateFeedbackForm(moduleId, (String) tokenParmeter, solutionKey));
                } else // Feedback is disabled
                {
                  log.debug("Feedback is disabled, Marking as completed");
                  String htmlOutput = new String();
                  result =
                      Setter.updatePlayerResult(
                          ApplicationRoot, moduleId, userId, "Feedback is Disabled", 1, 1, 1);
                  if (result != null) {
                    ResourceBundle bundle =
                        ResourceBundle.getBundle(
                            "i18n.moduleGenerics.moduleNames",
                            new Locale(Validate.validateLanguage(request.getSession())));
                    String compltedModuleLocalName = bundle.getString(result);
                    log.debug(
                        "Solution Submission for module " + compltedModuleLocalName + " succeeded");
                    htmlOutput =
                        new String(
                            "<h2 class=\"title\">Solution Submission Success</h2><br>"
                                + "<p>"
                                + compltedModuleLocalName
                                + " completed! Congratulations.");
                    htmlOutput += "</p>";
                    // Refresh Side Menu
                    htmlOutput +=
                        FeedbackSubmit.refreshMenuScript(
                            encoder.encodeForHTML((String) tokenParmeter), "Refresh Error");
                    log.debug("Resetting user's Bad Submisison count to 0");
                    Setter.resetBadSubmission(ApplicationRoot, userId);
                    out.write(htmlOutput);
                  } else {
                    htmlOutput = new String("Could not update user result");
                    out.print(
                        "<h2 class=\"title\">Solution Submission Failure</h2><br>"
                            + "<p><font color=\"red\">"
                            + "Sorry but an error Occurred!"
                            + "</font></p>");
                  }
                }
              } else {
                log.error("User has completed this module before. Returning Error");
                out.write(
                    "<h2 class=\"title\">Haven't You Done This Already?</h2><br>"
                        + "<p>"
                        + "Our records say you have already completed this module! Go try another one!"
                        + "</p>");
              }
            } else {
              log.error("Incorrect key submitted, returning error");
              out.print(
                  "<h2 class=\"title\">Solution Submission Failure</h2><br>"
                      + "<p><font color=\"red\">"
                      + "Incorrect Solution Key Submitted.<br><br>You have limited amounts of incorrect key submissions before you will loose 10% of your points. Contact the OWASP Security Shepherd if you think you have found the correct key but it is failing you."
                      + "</font></p>");

              log.error("Invoking Bad Submission procedure...");
              Setter.incrementBadSubmission(ApplicationRoot, userId);
              log.error(userName + " has been warned and potentially has lost points");
            }
          } else {
            // Validation Error Responses
            String errorMessage = "An Error Occurred: ";
            if (!notNull) {
              log.error("Null values detected");
              errorMessage += "Invalid Request. Please try again";
            } else if (storedResult == null) {
              log.error("Module not found");
              errorMessage += "Module Not Found. Please try again";
            }
            out.print(
                "<h2 class=\"title\">Solution Submission Failure</h2><br>"
                    + "<p><font color=\"red\">"
                    + encoder.encodeForHTML(errorMessage)
                    + "</font><p>");
          }
        } catch (Exception e) {
          log.error("Solution Submission Error: " + e.toString());
          out.print(
              "<h2 class=\"title\">Solution Submission Failure</h2><br>"
                  + "<p>"
                  + "<font color=\"red\">An error Occurred! Please try again.</font>"
                  + "<p>");
        }
      } else {
        log.debug("CSRF Tokens did not match");
        out.print(
            "<h2 class=\"title\">Solution Submission Failure</h2><br>"
                + "<p>"
                + "<font color=\"red\">An error Occurred! Please try again.</font>"
                + "<p>");
      }
    } else {
      out.print(
          "<h2 class=\"title\">Solution Submission Failure</h2><br>"
              + "<p>"
              + "<font color=\"red\">An error Occurred! Please Log in!</font>"
              + "<p>");
    }
    log.debug("&&& END SolutionSubmit &&&");
  }
  /**
   * Initiated by index.jsp, getStarted.jsp. This changes a users password. If the user gets it
   * wrong 3 times in a row, they'll be locked out (This is handed by database)
   *
   * @param csrfToken
   * @param currentPassword User's current password
   * @param newPassword Submitted new password
   * @param passwordConfirmation Confirmation of the new password
   */
  public void doPost(HttpServletRequest request, HttpServletResponse response)
      throws ServletException, IOException {
    // Setting IpAddress To Log and taking header for original IP if forwarded from proxy
    ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"));
    log.debug("*** servlets.ChangePassword ***");
    try {
      HttpSession ses = request.getSession(true);
      if (Validate.validateSession(ses)) {
        ShepherdLogManager.setRequestIp(
            request.getRemoteAddr(),
            request.getHeader("X-Forwarded-For"),
            ses.getAttribute("userName").toString());
        log.debug("Current User: "******"userName").toString());
        Cookie tokenCookie = Validate.getToken(request.getCookies());
        Object tokenParmeter = request.getParameter("csrfToken");
        if (Validate.validateTokens(tokenCookie, tokenParmeter)) {
          log.debug("Getting Parameters");
          String userName = (String) ses.getAttribute("userName");
          String currentPassword = (String) request.getParameter("currentPassword");
          String newPassword = (String) request.getParameter("newPassword");
          String passwordConfirm = (String) request.getParameter("passwordConfirmation");
          String ApplicationRoot = getServletContext().getRealPath("");

          boolean validData = false;
          boolean passwordChange = false;
          boolean validPassword = false;
          validData =
              newPassword.equalsIgnoreCase(passwordConfirm)
                  && !newPassword.isEmpty()
                  && newPassword != null;
          passwordChange = !currentPassword.equalsIgnoreCase(newPassword);
          validPassword = newPassword.length() > 4 && newPassword.length() <= 512;
          if (validData && passwordChange && validPassword) {
            log.debug("Validating Current Password");
            String user[] = Getter.authUser(ApplicationRoot, userName, currentPassword);
            if (user != null) {
              log.debug("User Credentials were good! Password Change gets the go ahead");
              Setter.updatePassword(ApplicationRoot, userName, currentPassword, newPassword);
              ses.setAttribute("ChangePassword", "false");
            } else {
              log.error("Incorrect Password");
              ses.setAttribute("errorMessage", "Incorrect Password... Don't lock yourself out!");
              response.sendRedirect("index.jsp");
            }
          } else {
            if (validData && passwordChange) {
              try {
                // User Account is Locked
                log.debug("The user account is locked. Logging the user out");
                Cookie cookieToken = Validate.getToken(request.getCookies());
                BigInteger temp = new BigInteger(cookieToken.getValue());
                response.sendRedirect("logout?csrfToken=" + temp);
              } catch (Exception e) {
                log.error(
                    "Cant Log the user out because they dont have a valid CSRF token : "
                        + e.toString());
                response.sendRedirect("login.jsp");
              }
            }
            // Return error message
            else if (!validData) {
              log.error("Bad Data Received");
              ses.setAttribute("errorMessage", "Invalid Request! Please try again.");
            } else if (!validPassword) {
              log.error("Invalid Password Submitted (Too Short/Long)");
              ses.setAttribute("errorMessage", "Invalid Password! Please try again.");
            } else {
              log.error("No password Change Detected");
              ses.setAttribute(
                  "errorMessage", "You have to CHANGE your password! Please try again.");
            }
          }
        } else {
          log.error("CSRF Attack Detected");
        }
      } else {
        log.error("Change Password Function Called with no valid session");
        response.sendRedirect("login.jsp");
      }
    } catch (Exception e) {
      log.fatal("ChangePassword Error: " + e.toString());
    }
    log.debug("*** END ChangePassword ***");
    response.sendRedirect("index.jsp");
  }