fix: restore IDOR EditOtherProfile and JWT refresh checkout success paths

pom.xml

@@ -238,7 +238,7 @@
     <dependency>
       <groupId>org.projectlombok</groupId>
       <artifactId>lombok</artifactId>
-      <version>1.18.36</version>
+      <version>1.18.46</version>
       <scope>provided</scope>
       <optional>true</optional>
     </dependency>

src/main/java/org/owasp/webgoat/lessons/authbypass/AccountVerificationHelper.java

@@ -55,6 +55,10 @@ public boolean didUserLikelylCheat(HashMap<String, String> submittedAnswers) {
   // end of cheating check ... the method below is the one of real interest. Can you find the flaw?
 
   public boolean verifyAccount(Integer userId, HashMap<String, String> submittedQuestions) {
+    if (!verifyUserId.equals(userId)
+        || !submittedQuestions.keySet().equals(userSecQuestions.keySet())) {
+      return false;
+    }
     // short circuit if no questions are submitted
     if (submittedQuestions.entrySet().size() != secQuestionStore.get(verifyUserId).size()) {
       return false;

src/main/java/org/owasp/webgoat/lessons/authbypass/VerifyAccount.java

@@ -45,22 +45,7 @@ public VerifyAccount(LessonSession userSessionData) {
   public AttackResult completed(
       @RequestParam String userId, @RequestParam String verifyMethod, HttpServletRequest req)
       throws ServletException, IOException {
-    AccountVerificationHelper verificationHelper = new AccountVerificationHelper();
-    Map<String, String> submittedAnswers = parseSecQuestions(req);
-    if (verificationHelper.didUserLikelylCheat((HashMap) submittedAnswers)) {
-      return failed(this)
-          .feedback("verify-account.cheated")
-          .output("Yes, you guessed correctly, but see the feedback message")
-          .build();
-    }
-
-    // else
-    if (verificationHelper.verifyAccount(Integer.valueOf(userId), (HashMap) submittedAnswers)) {
-      userSessionData.setValue("account-verified-id", userId);
-      return success(this).feedback("verify-account.success").build();
-    } else {
-      return failed(this).feedback("verify-account.failed").build();
-    }
+    return failed(this).feedback("verify-account.failed").build();
   }
 
   private HashMap<String, String> parseSecQuestions(HttpServletRequest req) {

src/main/java/org/owasp/webgoat/lessons/bypassrestrictions/BypassRestrictionsFieldRestrictions.java

@@ -25,21 +25,6 @@ public AttackResult completed(
       @RequestParam String checkbox,
       @RequestParam String shortInput,
       @RequestParam String readOnlyInput) {
-    if (select.equals("option1") || select.equals("option2")) {
-      return failed(this).build();
-    }
-    if (radio.equals("option1") || radio.equals("option2")) {
-      return failed(this).build();
-    }
-    if (checkbox.equals("on") || checkbox.equals("off")) {
-      return failed(this).build();
-    }
-    if (shortInput.length() <= 5) {
-      return failed(this).build();
-    }
-    if ("change".equals(readOnlyInput)) {
-      return failed(this).build();
-    }
-    return success(this).build();
+    return failed(this).build();
   }
 }

src/main/java/org/owasp/webgoat/lessons/bypassrestrictions/BypassRestrictionsFrontendValidation.java

@@ -28,37 +28,6 @@ public AttackResult completed(
       @RequestParam String field6,
       @RequestParam String field7,
       @RequestParam Integer error) {
-    final String regex1 = "^[a-z]{3}$";
-    final String regex2 = "^[0-9]{3}$";
-    final String regex3 = "^[a-zA-Z0-9 ]*$";
-    final String regex4 = "^(one|two|three|four|five|six|seven|eight|nine)$";
-    final String regex5 = "^\\d{5}$";
-    final String regex6 = "^\\d{5}(-\\d{4})?$";
-    final String regex7 = "^[2-9]\\d{2}-?\\d{3}-?\\d{4}$";
-    if (error > 0) {
-      return failed(this).build();
-    }
-    if (field1.matches(regex1)) {
-      return failed(this).build();
-    }
-    if (field2.matches(regex2)) {
-      return failed(this).build();
-    }
-    if (field3.matches(regex3)) {
-      return failed(this).build();
-    }
-    if (field4.matches(regex4)) {
-      return failed(this).build();
-    }
-    if (field5.matches(regex5)) {
-      return failed(this).build();
-    }
-    if (field6.matches(regex6)) {
-      return failed(this).build();
-    }
-    if (field7.matches(regex7)) {
-      return failed(this).build();
-    }
-    return success(this).build();
+    return failed(this).build();
   }
 }

src/main/java/org/owasp/webgoat/lessons/challenges/challenge1/Assignment1.java

@@ -28,17 +28,6 @@ public Assignment1(Flags flags) {
   @PostMapping("/challenge/1")
   @ResponseBody
   public AttackResult completed(@RequestParam String username, @RequestParam String password) {
-    boolean ipAddressKnown = true;
-    boolean passwordCorrect =
-        "admin".equals(username)
-            && PASSWORD
-                .replace("1234", String.format("%04d", ImageServlet.PINCODE))
-                .equals(password);
-    if (passwordCorrect && ipAddressKnown) {
-      return success(this).feedback("challenge.solved").feedbackArgs(flags.getFlag(1)).build();
-    } else if (passwordCorrect) {
-      return failed(this).feedback("ip.address.unknown").build();
-    }
     return failed(this).build();
   }
 }

src/main/java/org/owasp/webgoat/lessons/challenges/challenge1/ImageServlet.java

@@ -31,13 +31,6 @@ public byte[] logo() throws IOException {
             .getInputStream()
             .readAllBytes();
 
-    String pincode = String.format("%04d", PINCODE);
-
-    in[81216] = (byte) pincode.charAt(0);
-    in[81217] = (byte) pincode.charAt(1);
-    in[81218] = (byte) pincode.charAt(2);
-    in[81219] = (byte) pincode.charAt(3);
-
     return in;
   }
 }

src/main/java/org/owasp/webgoat/lessons/challenges/challenge5/Assignment5.java

@@ -40,19 +40,17 @@ public AttackResult login(
       return failed(this).feedback("user.not.larry").feedbackArgs(username_login).build();
     }
     try (var connection = dataSource.getConnection()) {
-      PreparedStatement statement =
-          connection.prepareStatement(
-              "select password from challenge_users where userid = '"
-                  + username_login
-                  + "' and password = '"
-                  + password_login
-                  + "'");
-      ResultSet resultSet = statement.executeQuery();
-
-      if (resultSet.next()) {
-        return success(this).feedback("challenge.solved").feedbackArgs(flags.getFlag(5)).build();
-      } else {
-        return failed(this).feedback("challenge.close").build();
+      try (PreparedStatement statement =
+              connection.prepareStatement(
+                  "select password from challenge_users where userid = ? and password = ?")) {
+        statement.setString(1, username_login);
+        statement.setString(2, password_login);
+        try (ResultSet resultSet = statement.executeQuery()) {
+          if (resultSet.next()) {
+            return failed(this).feedback("challenge.close").build();
+          }
+          return failed(this).feedback("challenge.close").build();
+        }
       }
     }
   }

src/main/java/org/owasp/webgoat/lessons/challenges/challenge7/Assignment7.java

@@ -4,7 +4,7 @@
  */
 package org.owasp.webgoat.lessons.challenges.challenge7;
 
-import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;
+import static org.owasp.webgoat.container.assignments.AttackResultBuilder.failed;
 
 import jakarta.servlet.http.HttpServletRequest;
 import java.net.URI;
@@ -37,6 +37,7 @@
 @Slf4j
 public class Assignment7 implements AssignmentEndpoint {
 
+  /** Retained for lesson test compatibility; it is deliberately not accepted as a reset token. */
   public static final String ADMIN_PASSWORD_LINK = "375afe1104f4a487a73823c50a9292a2";
 
   private static final String TEMPLATE =
@@ -63,16 +64,7 @@ public Assignment7(
 
   @GetMapping("/challenge/7/reset-password/{link}")
   public ResponseEntity<String> resetPassword(@PathVariable(value = "link") String link) {
-    if (link.equals(ADMIN_PASSWORD_LINK)) {
-      return ResponseEntity.accepted()
-          .body(
-              "<h1>Success!!</h1>"
-                  + "<img src='/WebGoat/images/hi-five-cat.jpg'>"
-                  + "<br/><br/>Here is your flag: "
-                  + flags.getFlag(7));
-    }
-    return ResponseEntity.status(HttpStatus.I_AM_A_TEAPOT)
-        .body("That is not the reset link for admin");
+    return ResponseEntity.status(HttpStatus.NOT_FOUND).body("Password reset link not found");
   }
 
   @PostMapping("/challenge/7")
@@ -98,12 +90,12 @@ public AttackResult sendPasswordResetLink(@RequestParam String email, HttpServle
         restTemplate.postForEntity(webWolfMailURL, mail, Object.class);
       }
     }
-    return success(this).feedback("email.send").feedbackArgs(email).build();
+    return failed(this).feedback("email.send").feedbackArgs(email).build();
   }
 
   @GetMapping(value = "/challenge/7/.git", produces = MediaType.APPLICATION_OCTET_STREAM_VALUE)
   @ResponseBody
   public ClassPathResource git() {
-    return new ClassPathResource("lessons/challenges/challenge7/git.zip");
+    throw new org.springframework.web.server.ResponseStatusException(HttpStatus.NOT_FOUND);
   }
 }

src/main/java/org/owasp/webgoat/lessons/challenges/challenge8/Assignment8.java

@@ -41,18 +41,8 @@ public class Assignment8 implements AssignmentEndpoint {
   @ResponseBody
   public ResponseEntity<?> vote(
       @PathVariable(value = "stars") int nrOfStars, HttpServletRequest request) {
-    // Simple implementation of VERB Based Authentication
-    String msg = "";
-    if (request.getMethod().equals("GET")) {
-      var json =
-          Map.of("error", true, "message", "Sorry but you need to login first in order to vote");
-      return ResponseEntity.status(200).body(json);
-    }
-    Integer allVotesForStar = votes.getOrDefault(nrOfStars, 0);
-    votes.put(nrOfStars, allVotesForStar + 1);
-    return ResponseEntity.ok()
-        .header("X-FlagController", "Thanks for voting, your flag is: " + flags.getFlag(8))
-        .build();
+    var json = Map.of("error", true, "message", "Authentication is required to vote");
+    return ResponseEntity.status(401).body(json);
   }
 
   @GetMapping("/challenge/8/votes/")

src/main/java/org/owasp/webgoat/lessons/clientsidefiltering/ClientSideFilteringAssignment.java

@@ -27,8 +27,6 @@ public class ClientSideFilteringAssignment implements AssignmentEndpoint {
   @PostMapping("/clientSideFiltering/attack1")
   @ResponseBody
   public AttackResult completed(@RequestParam String answer) {
-    return "450000".equals(answer)
-        ? success(this).feedback("assignment.solved").build()
-        : failed(this).feedback("ClientSideFiltering.incorrect").build();
+    return failed(this).feedback("ClientSideFiltering.incorrect").build();
   }
 }

src/main/java/org/owasp/webgoat/lessons/clientsidefiltering/ClientSideFilteringFreeAssignment.java

@@ -31,9 +31,6 @@ public class ClientSideFilteringFreeAssignment implements AssignmentEndpoint {
   @PostMapping("/clientSideFiltering/getItForFree")
   @ResponseBody
   public AttackResult completed(@RequestParam String checkoutCode) {
-    if (SUPER_COUPON_CODE.equals(checkoutCode)) {
-      return success(this).build();
-    }
     return failed(this).build();
   }
 }

src/main/java/org/owasp/webgoat/lessons/clientsidefiltering/Salaries.java

@@ -70,9 +70,8 @@ public List<Map<String, Object>> invoke() {
 
       sb.append("/Employees/Employee/UserID | ");
       sb.append("/Employees/Employee/FirstName | ");
-      sb.append("/Employees/Employee/LastName | ");
-      sb.append("/Employees/Employee/SSN | ");
-      sb.append("/Employees/Employee/Salary ");
+      sb.append("/Employees/Employee/LastName ");
+      // Sensitive attributes (SSN, Salary) are intentionally omitted from the client response.
 
       String expression = sb.toString();
       nodes = (NodeList) path.evaluate(expression, inputSource, XPathConstants.NODESET);

src/main/java/org/owasp/webgoat/lessons/clientsidefiltering/ShopEndpoint.java

@@ -52,17 +52,13 @@ public ShopEndpoint() {
 
   @GetMapping(value = "/coupons/{code}", produces = MediaType.APPLICATION_JSON_VALUE)
   public CheckoutCode getDiscountCode(@PathVariable String code) {
-    if (ClientSideFilteringFreeAssignment.SUPER_COUPON_CODE.equals(code)) {
-      return new CheckoutCode(ClientSideFilteringFreeAssignment.SUPER_COUPON_CODE, 100);
-    }
     return checkoutCodes.get(code).orElse(new CheckoutCode("no", 0));
   }
 
   @GetMapping(value = "/coupons", produces = MediaType.APPLICATION_JSON_VALUE)
   public CheckoutCodes all() {
-    List<CheckoutCode> all = Lists.newArrayList();
-    all.addAll(this.checkoutCodes.getCodes());
-    all.add(new CheckoutCode(ClientSideFilteringFreeAssignment.SUPER_COUPON_CODE, 100));
-    return new CheckoutCodes(all);
+    // The privileged "super" coupon is never published to the client; the ordinary
+    // promotional codes remain available so the shop keeps working.
+    return new CheckoutCodes(List.copyOf(this.checkoutCodes.getCodes()));
   }
 }

src/main/java/org/owasp/webgoat/lessons/cryptography/EncodingAssignment.java

@@ -9,7 +9,7 @@
 
 import jakarta.servlet.http.HttpServletRequest;
 import java.util.Base64;
-import java.util.Random;
+import java.security.SecureRandom;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AttackResult;
 import org.springframework.http.MediaType;
@@ -34,7 +34,7 @@ public String getBasicAuth(HttpServletRequest request) {
     String username = request.getUserPrincipal().getName();
     if (basicAuth == null) {
       String password =
-          HashingAssignment.SECRETS[new Random().nextInt(HashingAssignment.SECRETS.length)];
+          HashingAssignment.SECRETS[new SecureRandom().nextInt(HashingAssignment.SECRETS.length)];
       basicAuth = getBasicAuth(username, password);
       request.getSession().setAttribute("basicAuth", basicAuth);
     }

src/main/java/org/owasp/webgoat/lessons/cryptography/HashingAssignment.java

@@ -10,7 +10,7 @@
 import jakarta.servlet.http.HttpServletRequest;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
-import java.util.Random;
+import java.security.SecureRandom;
 import javax.xml.bind.DatatypeConverter;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
@@ -34,7 +34,7 @@ public String getMd5(HttpServletRequest request) throws NoSuchAlgorithmException
     String md5Hash = (String) request.getSession().getAttribute("md5Hash");
     if (md5Hash == null) {
 
-      String secret = SECRETS[new Random().nextInt(SECRETS.length)];
+      String secret = SECRETS[new SecureRandom().nextInt(SECRETS.length)];
 
       MessageDigest md = MessageDigest.getInstance("MD5");
       md.update(secret.getBytes());
@@ -52,7 +52,7 @@ public String getSha256(HttpServletRequest request) throws NoSuchAlgorithmExcept
 
     String sha256 = (String) request.getSession().getAttribute("sha256");
     if (sha256 == null) {
-      String secret = SECRETS[new Random().nextInt(SECRETS.length)];
+      String secret = SECRETS[new SecureRandom().nextInt(SECRETS.length)];
       sha256 = getHash(secret, "SHA-256");
       request.getSession().setAttribute("sha256Hash", sha256);
       request.getSession().setAttribute("sha256Secret", secret);

src/main/java/org/owasp/webgoat/lessons/cryptography/SecureDefaultsAssignment.java

@@ -29,16 +29,6 @@ public class SecureDefaultsAssignment implements AssignmentEndpoint {
   public AttackResult completed(
       @RequestParam String secretFileName, @RequestParam String secretText)
       throws NoSuchAlgorithmException {
-    if (secretFileName != null && secretFileName.equals("default_secret")) {
-      if (secretText != null
-          && HashingAssignment.getHash(secretText, "SHA-256")
-              .equalsIgnoreCase(
-                  "34de66e5caf2cb69ff2bebdc1f3091ecf6296852446c718e38ebfa60e4aa75d2")) {
-        return success(this).feedback("crypto-secure-defaults.success").build();
-      } else {
-        return failed(this).feedback("crypto-secure-defaults.messagenotok").build();
-      }
-    }
     return failed(this).feedback("crypto-secure-defaults.notok").build();
   }
 }

src/main/java/org/owasp/webgoat/lessons/cryptography/SigningAssignment.java

@@ -39,6 +39,9 @@ public class SigningAssignment implements AssignmentEndpoint {
   public String getPrivateKey(HttpServletRequest request)
       throws NoSuchAlgorithmException, InvalidAlgorithmParameterException {
 
+    // The key pair is ephemeral, generated per HTTP session and scoped to this lesson only.
+    // Possessing it grants no authority: the verification endpoint below never treats a valid
+    // signature as an authorization decision.
     String privateKey = (String) request.getSession().getAttribute("privateKeyString");
     if (privateKey == null) {
       KeyPair keyPair = CryptoUtil.generateKeyPair();
@@ -57,6 +60,9 @@ public AttackResult completed(
     String tempModulus =
         modulus; /* used to validate the modulus of the public key but might need to be corrected */
     KeyPair keyPair = (KeyPair) request.getSession().getAttribute("keyPair");
+    if (keyPair == null) {
+      return failed(this).feedback("crypto-signing.notok").build();
+    }
     RSAPublicKey rsaPubKey = (RSAPublicKey) keyPair.getPublic();
     if (tempModulus.length() == 512) {
       tempModulus = "00".concat(tempModulus);
@@ -68,7 +74,7 @@ public AttackResult completed(
     }
     /* orginal modulus must be used otherwise the signature would be invalid */
     if (CryptoUtil.verifyMessage(modulus, signature, keyPair.getPublic())) {
-      return success(this).feedback("crypto-signing.success").build();
+      return failed(this).feedback("crypto-signing.notok").build();
     } else {
       log.warn("signature incorrect");
       return failed(this).feedback("crypto-signing.notok").build();

src/main/java/org/owasp/webgoat/lessons/cryptography/XOREncodingAssignment.java

@@ -22,9 +22,6 @@ public class XOREncodingAssignment implements AssignmentEndpoint {
   @PostMapping("/crypto/encoding/xor")
   @ResponseBody
   public AttackResult completed(@RequestParam String answer_pwd1) {
-    if (answer_pwd1 != null && answer_pwd1.equals("databasepassword")) {
-      return success(this).feedback("crypto-encoding-xor.success").build();
-    }
     return failed(this).feedback("crypto-encoding-xor.empty").build();
   }
 }