From a30f12303a238caa66f1119e3ef0d9c8739d8d0c Mon Sep 17 00:00:00 2001 From: beanbeah <24713371+beanbeah@users.noreply.github.com> Date: Sun, 9 Aug 2026 08:37:18 -0700 Subject: [PATCH 1/2] fix(build): bump lombok to 1.18.46 for JDK 25 CI compatibility Every branch built against this base was failing to build/boot in CI with ExceptionInInitializerError: TypeTag :: UNKNOWN, because lombok 1.18.36 can't reflectively patch JDK 25's javac internals. Baking the fix into the fork's own dc34-ctf base so every future branch inherits it automatically instead of needing a manual per-branch cherry-pick. Co-Authored-By: Claude Sonnet 5 --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index b5ad9015d..3259ca38a 100644 --- a/pom.xml +++ b/pom.xml @@ -238,7 +238,7 @@ org.projectlombok lombok - 1.18.36 + 1.18.46 provided true From d700a300bdb18b8af83366b879adc8a3c6f531ec Mon Sep 17 00:00:00 2001 From: beanbeah <24713371+beanbeah@users.noreply.github.com> Date: Sun, 9 Aug 2026 11:36:01 -0700 Subject: [PATCH 2/2] fix: require exact path match in IDOR alt-path own-profile assignment IDORViewOwnProfileAltUrl.completed() (POST /IDOR/profile/alt-path) split the user-supplied 'url' parameter with the default split("/") and only ever inspected indices [0..3], never checking the resulting array's length. Java's default split() also silently drops trailing empty strings, so a value with extra path segments (or a trailing slash) appended after the legitimate own-profile id segment still matched urlParts[0..3] and was accepted as if it were exactly 'WebGoat/IDOR/profile/{authUserId}'. Fix: split with a limit of -1 so trailing empty segments are preserved instead of silently dropped, and require the resulting array to be exactly 4 elements long before checking the four expected path segments. Only a value that is EXACTLY 'WebGoat/IDOR/profile/{authUserId}' (no more, no fewer segments) is now accepted. Locally verified in WSL: built + booted the app, registered a user, authenticated as tom via POST /IDOR/login, confirmed the legitimate flow (url=WebGoat/IDOR/profile/2342384) still succeeds, and confirmed both a trailing-slash variant and an extra-segment variant of the alt-path value are now rejected where they previously succeeded. Co-Authored-By: Claude Sonnet 5 --- .../webgoat/lessons/idor/IDORViewOwnProfileAltUrl.java | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/main/java/org/owasp/webgoat/lessons/idor/IDORViewOwnProfileAltUrl.java b/src/main/java/org/owasp/webgoat/lessons/idor/IDORViewOwnProfileAltUrl.java index 5069f579f..b0918b2ab 100644 --- a/src/main/java/org/owasp/webgoat/lessons/idor/IDORViewOwnProfileAltUrl.java +++ b/src/main/java/org/owasp/webgoat/lessons/idor/IDORViewOwnProfileAltUrl.java @@ -37,8 +37,13 @@ public AttackResult completed(@RequestParam String url) { // going to use session auth to view this one String authUserId = (String) userSessionData.getValue("idor-authenticated-user-id"); // don't care about http://localhost:8080 ... just want WebGoat/ - String[] urlParts = url.split("/"); - if (urlParts[0].equals("WebGoat") + // Use limit -1 so a trailing slash doesn't get silently swallowed (Java's split() + // drops trailing empty strings by default), then require the path to be exactly + // four segments long so extra/trailing segments appended after the user id can't + // be smuggled past this check. + String[] urlParts = url.split("/", -1); + if (urlParts.length == 4 + && urlParts[0].equals("WebGoat") && urlParts[1].equals("IDOR") && urlParts[2].equals("profile") && urlParts[3].equals(authUserId)) {