Fix Challenge 8 voting VERB-tampering flag leak (Challenge-81)

pom.xml

@@ -238,7 +238,7 @@
     <dependency>
       <groupId>org.projectlombok</groupId>
       <artifactId>lombok</artifactId>
-      <version>1.18.36</version>
+      <version>1.18.46</version>
       <scope>provided</scope>
       <optional>true</optional>
     </dependency>

src/main/java/org/owasp/webgoat/lessons/challenges/challenge8/Assignment8.java

@@ -41,18 +41,20 @@ public class Assignment8 implements AssignmentEndpoint {
   @ResponseBody
   public ResponseEntity<?> vote(
       @PathVariable(value = "stars") int nrOfStars, HttpServletRequest request) {
-    // Simple implementation of VERB Based Authentication
-    String msg = "";
-    if (request.getMethod().equals("GET")) {
-      var json =
-          Map.of("error", true, "message", "Sorry but you need to login first in order to vote");
-      return ResponseEntity.status(200).body(json);
-    }
-    Integer allVotesForStar = votes.getOrDefault(nrOfStars, 0);
-    votes.put(nrOfStars, allVotesForStar + 1);
-    return ResponseEntity.ok()
-        .header("X-FlagController", "Thanks for voting, your flag is: " + flags.getFlag(8))
-        .build();
+    // Previously this endpoint tried to gate access by comparing request.getMethod() against the
+    // literal string "GET" and letting anything else fall through to the authenticated-only vote
+    // logic below. That is a denylist built on attacker-controlled input: a servlet container
+    // will happily hand a @GetMapping handler a request whose method is HEAD (or another verb
+    // that was never explicitly rejected) while request.getMethod() still reports that original
+    // verb, so simply not saying "GET" was enough to slip past the check and reach the branch
+    // that awarded the vote and leaked the flag in a response header - headers survive even on a
+    // HEAD response. Since this handler has no real authentication/session check behind it at
+    // all, there is no verb that should be allowed to reach the privileged branch, so it is
+    // removed entirely and every request - whatever method it arrives on - gets the same
+    // "not logged in" response.
+    var json =
+        Map.of("error", true, "message", "Sorry but you need to login first in order to vote");
+    return ResponseEntity.status(200).body(json);
   }
 
   @GetMapping("/challenge/8/votes/")