Skip to content

Commit 3923c25

Browse files
AndriiPiatakhaAndriiPiatakha
committed
Security Misconfiguration examples
1 parent f41b6da commit 3923c25

File tree

4 files changed

+134
-2
lines changed

4 files changed

+134
-2
lines changed

Diff for: ‎online-store.web/pom.xml

+7
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,13 @@
4040
<scope>provided</scope>
4141
</dependency>
4242

43+
<dependency>
44+
<groupId>jakarta.annotation</groupId>
45+
<artifactId>jakarta.annotation-api</artifactId>
46+
<version>2.1.0</version>
47+
</dependency>
48+
49+
4350
</dependencies>
4451

4552
<build>

Diff for: ‎online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/sm/problem/SignInServlet.java

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
package com.itbulls.learnit.onlinestore.web.owasp.sm.problem;
2+
3+
import static com.itbulls.learnit.onlinestore.persistence.dto.RoleDto.*;
4+
5+
import jakarta.servlet.http.HttpServlet;
6+
import java.io.IOException;
7+
8+
import com.itbulls.learnit.onlinestore.core.facades.UserFacade;
9+
import com.itbulls.learnit.onlinestore.core.facades.impl.DefaultUserFacade;
10+
import com.itbulls.learnit.onlinestore.persistence.enteties.User;
11+
import com.itbulls.learnit.onlinestore.web.Configurations;
12+
13+
import jakarta.servlet.ServletException;
14+
import jakarta.servlet.annotation.WebServlet;
15+
import jakarta.servlet.http.HttpServletRequest;
16+
import jakarta.servlet.http.HttpServletResponse;
17+
18+
@WebServlet("/signin-security-misconfiguration")
19+
public class SignInServlet extends HttpServlet {
20+
21+
public static final String LOGGED_IN_USER_ATTR = "loggedInUser";
22+
23+
private UserFacade userFacade = DefaultUserFacade.getInstance();
24+
25+
26+
@Override
27+
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
28+
request.getRequestDispatcher(Configurations.VIEWS_PATH_RESOLVER
29+
+ "signin-with-error-in-console.jsp").forward(request, response);
30+
}
31+
32+
33+
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
34+
User user = userFacade.getUserByEmail(request.getParameter("email"));
35+
String baseUrl = request.getScheme()
36+
+ "://"
37+
+ request.getServerName()
38+
+ ":"
39+
+ request.getServerPort()
40+
+ request.getServletContext().getContextPath();
41+
if (user != null && user.getPassword().equals(request.getParameter("password"))) {
42+
request.getSession().setAttribute(LOGGED_IN_USER_ATTR, user);
43+
if (user.getRoleName().equals(ADMIN_ROLE_NAME)) {
44+
response.sendRedirect(baseUrl + "/admin/panel");
45+
} else {
46+
response.sendRedirect(baseUrl + "/homepage");
47+
}
48+
} else {
49+
response.sendRedirect(baseUrl + "/signin-security-misconfiguration");
50+
}
51+
52+
}
53+
54+
}

Diff for: ‎online-store.web/src/main/webapp/META-INF/context.xml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<context useHttpOnly="false">
2+
<Context useHttpOnly="false">
33

44

55
<Resource name="jdbc/connpool"
@@ -41,4 +41,4 @@
4141
<!-- url: The JDBC connection url for connecting to your MySQL database.
4242
-->
4343

44-
</context>
44+
</Context>

Diff for: ‎online-store.web/src/main/webapp/WEB-INF/views/signin-with-error-in-console.jsp

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<%@ taglib prefix="shop" tagdir="/WEB-INF/tags/shop"%>
2+
<!DOCTYPE html>
3+
<html lang="en">
4+
<head>
5+
<title>Sign In</title>
6+
<meta charset="UTF-8">
7+
<meta name="viewport" content="width=device-width, initial-scale=1">
8+
9+
<shop:css-imports-main/>
10+
<shop:css-imports-signin/>
11+
</head>
12+
<body>
13+
14+
<shop:header/>
15+
16+
<div class="limiter">
17+
<div class="container-login100">
18+
<div class="wrap-login100">
19+
<form class="login100-form validate-form" action="signin-security-misconfiguration" method="POST">
20+
<span class="login100-form-title p-b-26">
21+
Welcome
22+
</span>
23+
24+
<div class="wrap-input100 validate-input" data-validate = "Valid email is: [email protected]">
25+
<input class="input100" type="text" name="email">
26+
<span class="focus-input100" data-placeholder="Email"></span>
27+
</div>
28+
29+
<div class="wrap-input100 validate-input" data-validate="Enter password">
30+
<span class="btn-show-pass">
31+
<i class="zmdi zmdi-eye"></i>
32+
</span>
33+
<input class="input100" type="password" name="password">
34+
<span class="focus-input100" data-placeholder="Password"></span>
35+
</div>
36+
37+
<div class="container-login100-form-btn">
38+
<div class="wrap-login100-form-btn">
39+
<div class="login100-form-bgbtn"></div>
40+
<button id="sign-in-btn" class="login100-form-btn">
41+
Sign In
42+
</button>
43+
</div>
44+
</div>
45+
46+
<div class="text-center p-t-115">
47+
<span class="txt1">
48+
Don't have an account?
49+
</span>
50+
51+
<a class="txt2" href="signup">
52+
Sign Up
53+
</a>
54+
</div>
55+
</form>
56+
</div>
57+
</div>
58+
</div>
59+
60+
<shop:footer/>
61+
<shop:js-imports-signin/>
62+
63+
<script type="text/javascript">
64+
$('#sign-in-btn').click(function(event) {
65+
event.preventDefault();
66+
// this code is for the demo and example purposes only. It prints hardcoded values just for the sake of example
67+
console.log('Password "testtest*asd" for user {email: "[email protected]", password: "testtest*"} is not correct');
68+
});
69+
</script>
70+
</body>
71+
</html>

0 commit comments

Comments
 (0)