Skip to content

Commit 25a2912

Browse files
AndriiPiatakhaAndriiPiatakha
committed
Broken Access Control demo
1 parent b5bd84d commit 25a2912

File tree

21 files changed

+463
-3
lines changed

21 files changed

+463
-3
lines changed

Diff for: ‎online-store.core/src/main/java/com/itbulls/learnit/onlinestore/core/facades/ProductFacade.java

+2
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,6 @@ List<Product> getProductsLikeNameForPageWithLimit(String searchQuery, Integer pa
2121

2222
Product getProductById(Integer parameter);
2323

24+
Product getProductByGuid(String guid);
25+
2426
}

Diff for: ‎online-store.core/src/main/java/com/itbulls/learnit/onlinestore/core/facades/impl/DefaultProductFacade.java

+5
Original file line numberDiff line numberDiff line change
@@ -74,4 +74,9 @@ public Product getProductById(Integer productId) {
7474
return productConverter.convertProductDtoToProduct(productDao.getProductById(productId));
7575
}
7676

77+
@Override
78+
public Product getProductByGuid(String guid) {
79+
return productConverter.convertProductDtoToProduct(productDao.getProductByGuid(guid));
80+
}
81+
7782
}

Diff for: ‎online-store.persistence/src/main/java/com/itbulls/learnit/onlinestore/persistence/dao/ProductDao.java

+2
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,7 @@ public interface ProductDao {
2222
Integer getProductCountForSearch(String searchQuery);
2323

2424
List<ProductDto> getProductsLikeNameForPageWithLimit(String searchQuery, Integer page, Integer paginationLimit);
25+
26+
ProductDto getProductByGuid(String guid);
2527

2628
}

Diff for: ‎online-store.persistence/src/main/java/com/itbulls/learnit/onlinestore/persistence/dao/impl/MySqlJdbcProductDao.java

+21
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ private ProductDto populateProductDto(ResultSet rs) throws SQLException {
6262
product.setCategoryDto(categoryDao.getCategoryByCategoryId(rs.getInt("category_id")));
6363
product.setImgName(rs.getString("img_name"));
6464
product.setDescription(rs.getString("description"));
65+
product.setGuid(rs.getString("guid"));
6566
return product;
6667
}
6768

@@ -217,5 +218,25 @@ public List<ProductDto> getProductsLikeNameForPageWithLimit(String searchQuery,
217218
}
218219
return null;
219220
}
221+
222+
223+
@Override
224+
public ProductDto getProductByGuid(String guid) {
225+
try (var conn = DBUtils.getConnection();
226+
var ps = conn.prepareStatement("SELECT * FROM product WHERE guid = ?")) {
227+
228+
ps.setString(1, guid);
229+
try (var rs = ps.executeQuery()) {
230+
231+
if (rs.next()) {
232+
ProductDto product = populateProductDto(rs);
233+
return product;
234+
}
235+
}
236+
} catch (SQLException e) {
237+
e.printStackTrace();
238+
}
239+
return null;
240+
}
220241

221242
}

Diff for: ‎online-store.persistence/src/main/java/com/itbulls/learnit/onlinestore/persistence/dto/ProductDto.java

+7
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ public class ProductDto {
1010
private CategoryDto categoryDto;
1111
private String imgName;
1212
private String description;
13+
private String guid;
1314

1415
public int getId() {
1516
return id;
@@ -47,5 +48,11 @@ public String getDescription() {
4748
public void setDescription(String description) {
4849
this.description = description;
4950
}
51+
public void setGuid(String guid) {
52+
this.guid = guid;
53+
}
54+
public String getGuid() {
55+
return this.guid;
56+
}
5057

5158
}

Diff for: ‎online-store.persistence/src/main/java/com/itbulls/learnit/onlinestore/persistence/dto/converters/ProductDtoToProductConverter.java

+2
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ public Product convertProductDtoToProduct(ProductDto productDto) {
3838
product.setCategoryName(productDto.getCategoryDto().getCategoryName());
3939
product.setImgName(productDto.getImgName());
4040
product.setDescription(productDto.getDescription());
41+
product.setGuid(productDto.getGuid());
4142
}
4243
return product;
4344
}
@@ -60,6 +61,7 @@ private ProductDto convertProductToProductDto(Product product) {
6061
productDto.setProductName(product.getProductName());
6162
productDto.setImgName(product.getImgName());
6263
productDto.setDescription(product.getDescription());
64+
productDto.setGuid(product.getGuid());
6365
return productDto;
6466
}
6567

Diff for: ‎online-store.persistence/src/main/java/com/itbulls/learnit/onlinestore/persistence/enteties/Product.java

+4
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,8 @@ public interface Product extends Serializable {
2727
void setDescription(String description);
2828

2929
String getDescription();
30+
31+
void setGuid(String guid);
32+
33+
String getGuid();
3034
}

Diff for: ‎online-store.persistence/src/main/java/com/itbulls/learnit/onlinestore/persistence/enteties/impl/ComparableProduct.java

+11
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ public class ComparableProduct implements Product, Comparable<Product> {
1010
private double price;
1111
private String imgName;
1212
private String description;
13+
private String guid;
1314

1415
public ComparableProduct() {
1516
}
@@ -92,4 +93,14 @@ public String getDescription() {
9293
return this.description;
9394
}
9495

96+
@Override
97+
public void setGuid(String guid) {
98+
this.guid = guid;
99+
}
100+
101+
@Override
102+
public String getGuid() {
103+
return this.guid;
104+
}
105+
95106
}

Diff for: ‎online-store.persistence/src/main/java/com/itbulls/learnit/onlinestore/persistence/enteties/impl/DefaultProduct.java

+11
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ public class DefaultProduct implements Product {
1010
private double price;
1111
private String imgName;
1212
private String description;
13+
private String guid;
1314

1415
public DefaultProduct() {
1516
}
@@ -82,4 +83,14 @@ public String getDescription() {
8283
public void setDescription(String description) {
8384
this.description = description;
8485
}
86+
87+
@Override
88+
public void setGuid(String guid) {
89+
this.guid = guid;
90+
}
91+
92+
@Override
93+
public String getGuid() {
94+
return this.guid;
95+
}
8596
}

Diff for: ‎online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/controllers/EditProfileServlet.java

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
package com.itbulls.learnit.onlinestore.web.controllers;
2+
3+
import java.io.IOException;
4+
import java.util.ResourceBundle;
5+
6+
import com.itbulls.learnit.onlinestore.core.facades.UserFacade;
7+
import com.itbulls.learnit.onlinestore.core.facades.impl.DefaultUserFacade;
8+
import com.itbulls.learnit.onlinestore.core.services.Validator;
9+
import com.itbulls.learnit.onlinestore.core.services.impl.PasswordValidator;
10+
import com.itbulls.learnit.onlinestore.persistence.enteties.User;
11+
import com.itbulls.learnit.onlinestore.web.Configurations;
12+
13+
import jakarta.servlet.ServletException;
14+
import jakarta.servlet.annotation.WebServlet;
15+
import jakarta.servlet.http.HttpServlet;
16+
import jakarta.servlet.http.HttpServletRequest;
17+
import jakarta.servlet.http.HttpServletResponse;
18+
19+
@WebServlet("/edit-profile")
20+
public class EditProfileServlet extends HttpServlet {
21+
private UserFacade userFacade = DefaultUserFacade.getInstance();
22+
private Validator passValidator = PasswordValidator.getInstance();
23+
private ResourceBundle rb = ResourceBundle.getBundle(Configurations.RESOURCE_BUNDLE_BASE_NAME);
24+
25+
26+
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
27+
// TODO - if not logged in - then redirect to the sign in
28+
User loggedInUser = (User)request.getSession().getAttribute(SignInServlet.LOGGED_IN_USER_ATTR);
29+
30+
if (loggedInUser == null) {
31+
String baseUrl = request.getScheme()
32+
+ "://"
33+
+ request.getServerName()
34+
+ ":"
35+
+ request.getServerPort()
36+
+ request.getServletContext().getContextPath();
37+
response.sendRedirect(baseUrl + "/signin");
38+
39+
} else {
40+
request.getRequestDispatcher(Configurations.VIEWS_PATH_RESOLVER + "editProfile.jsp").forward(request, response);
41+
}
42+
43+
44+
}
45+
46+
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
47+
String baseUrl = request.getScheme()
48+
+ "://"
49+
+ request.getServerName()
50+
+ ":"
51+
+ request.getServerPort()
52+
+ request.getServletContext().getContextPath();
53+
54+
User loggedInUser = (User)request.getSession().getAttribute(SignInServlet.LOGGED_IN_USER_ATTR);
55+
// need to do this to extract latest state of the user
56+
User user = userFacade.getUserById(loggedInUser.getId());
57+
user.setFirstName(request.getParameter("firstName"));
58+
user.setLastName(request.getParameter("lastName"));
59+
String emailParameter = request.getParameter("email");
60+
user.setEmail(emailParameter);
61+
String newPasswordParameter = request.getParameter("newPassword");
62+
if (newPasswordParameter != null && !newPasswordParameter.isEmpty()) {
63+
user.setPassword(newPasswordParameter);
64+
}
65+
66+
67+
User userByEmail = userFacade.getUserByEmail(user.getEmail());
68+
69+
if (userByEmail != null && !emailParameter.equals(loggedInUser.getEmail())) {
70+
request.getSession().setAttribute("errMsg", rb.getString("signup.err.msg.email.exists"));
71+
response.sendRedirect(baseUrl + "/edit-profile");
72+
return;
73+
}
74+
75+
System.out.println(request.getParameter("password").equals(loggedInUser.getPassword()));
76+
System.out.println(loggedInUser.getPassword());
77+
78+
if (!request.getParameter("password").equals(loggedInUser.getPassword())) {
79+
request.getSession().setAttribute("errMsg", rb.getString("signup.err.msg.old.password.wrong"));
80+
response.sendRedirect(baseUrl + "/edit-profile");
81+
return;
82+
}
83+
84+
if (newPasswordParameter != null && !newPasswordParameter.isEmpty() && !passValidator.isValid(user.getPassword())) {
85+
request.getSession().setAttribute("errMsg", rb.getString("signup.err.msg.special.character"));
86+
response.sendRedirect(baseUrl + "/edit-profile");
87+
return;
88+
}
89+
90+
91+
userFacade.updateUser(user);
92+
response.sendRedirect(baseUrl + "/my-profile");
93+
}
94+
95+
}

Diff for: ‎online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/bac/problem/GetPictureServlet.java

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
package com.itbulls.learnit.onlinestore.web.owasp.bac.problem;
2+
3+
import jakarta.servlet.http.HttpServlet;
4+
import java.io.IOException;
5+
import jakarta.servlet.ServletException;
6+
import jakarta.servlet.annotation.WebServlet;
7+
import jakarta.servlet.http.HttpServletRequest;
8+
import jakarta.servlet.http.HttpServletResponse;
9+
10+
@WebServlet("/get-pic")
11+
public class GetPictureServlet extends HttpServlet {
12+
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
13+
String picName = request.getParameter("name");
14+
if (picName != null && !picName.isBlank()) {
15+
request.getRequestDispatcher("images/" + picName).forward(request, response);
16+
}
17+
18+
/*
19+
* Validations can be bypassed:
20+
* - instead of ../ I can use %2e%2e%2f
21+
* - instead of validation of file extension, I can pass null byte
22+
*
23+
*/
24+
25+
}
26+
}

Diff for: ‎online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/bac/problem/UserProfileServlet.java

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
package com.itbulls.learnit.onlinestore.web.owasp.bac.problem;
2+
3+
import jakarta.servlet.http.HttpServlet;
4+
import java.io.IOException;
5+
import java.util.List;
6+
7+
import com.itbulls.learnit.onlinestore.core.facades.UserFacade;
8+
import com.itbulls.learnit.onlinestore.core.facades.impl.DefaultUserFacade;
9+
import com.itbulls.learnit.onlinestore.persistence.enteties.User;
10+
import com.itbulls.learnit.onlinestore.web.Configurations;
11+
import com.itbulls.learnit.onlinestore.web.controllers.SignInServlet;
12+
import com.itbulls.learnit.onlinestore.web.filters.PartnerCodeFilter;
13+
14+
import jakarta.servlet.ServletException;
15+
import jakarta.servlet.annotation.WebServlet;
16+
import jakarta.servlet.http.HttpServletRequest;
17+
import jakarta.servlet.http.HttpServletResponse;
18+
19+
@WebServlet("/user-profile")
20+
public class UserProfileServlet extends HttpServlet {
21+
22+
private UserFacade userFacade = DefaultUserFacade.getInstance();
23+
24+
protected void doGet(HttpServletRequest request, HttpServletResponse response)
25+
throws ServletException, IOException {
26+
String stringId = request.getParameter("id");
27+
if (stringId != null && !stringId.isBlank()) {
28+
User user = userFacade.getUserById(Integer.valueOf(stringId));
29+
30+
String baseUrl = request.getScheme() + "://" + request.getServerName() + ":" + request.getServerPort()
31+
+ request.getServletContext().getContextPath();
32+
String partnerLink = baseUrl + "?" + PartnerCodeFilter.PARTNER_CODE_PARAMETER_NAME + "="
33+
+ user.getPartnerCode();
34+
List<User> referrals = userFacade.getReferralsForUser(user);
35+
request.setAttribute(SignInServlet.LOGGED_IN_USER_ATTR, user);
36+
request.setAttribute("referrals", referrals);
37+
request.setAttribute("partnerLink", partnerLink);
38+
request.getRequestDispatcher(Configurations.VIEWS_PATH_RESOLVER + "/myProfile.jsp").forward(request,
39+
response);
40+
} else {
41+
request.getRequestDispatcher(Configurations.VIEWS_PATH_RESOLVER + "/signin.jsp").forward(request, response);
42+
}
43+
44+
}
45+
}

Diff for: ‎online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/bac/solution/GetPictureServlet.java

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
package com.itbulls.learnit.onlinestore.web.owasp.bac.solution;
2+
3+
import jakarta.servlet.http.HttpServlet;
4+
5+
import java.io.File;
6+
import java.io.IOException;
7+
import java.io.InputStream;
8+
import java.net.MalformedURLException;
9+
import java.net.URISyntaxException;
10+
import java.net.URL;
11+
import java.nio.file.Path;
12+
import java.nio.file.Paths;
13+
import java.util.ArrayList;
14+
import java.util.Arrays;
15+
import java.util.List;
16+
17+
import jakarta.servlet.ServletContext;
18+
import jakarta.servlet.ServletException;
19+
import jakarta.servlet.annotation.WebServlet;
20+
import jakarta.servlet.http.HttpServletRequest;
21+
import jakarta.servlet.http.HttpServletResponse;
22+
23+
@WebServlet("/get-pic-solution")
24+
public class GetPictureServlet extends HttpServlet {
25+
26+
private List<String> imageNames = new ArrayList<>();
27+
28+
29+
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
30+
populateImageNames();
31+
32+
String picName = request.getParameter("name");
33+
if (picName != null && !picName.isBlank()) {
34+
if (imageNames.contains(picName)) {
35+
request.getRequestDispatcher("images/" + picName).forward(request, response);
36+
} else {
37+
response.getWriter().println("No picutre with such name is available.");
38+
}
39+
}
40+
}
41+
42+
43+
private void populateImageNames() throws MalformedURLException {
44+
ServletContext context = getServletContext();
45+
URL imagesUrl = context.getResource("/images");
46+
try {
47+
Path imagesPath = Paths.get(imagesUrl.toURI());
48+
File f = imagesPath.toFile();
49+
Arrays.stream(f.listFiles()).forEach(image -> imageNames.add(image.getName()));
50+
} catch (URISyntaxException e) {
51+
e.printStackTrace();
52+
}
53+
}
54+
}

0 commit comments

Comments
 (0)