I grabbed the instructor code from the Legacy Webgoat code base, no problem.

HOWEVER, when I run through the XSS lab now, it appears that the default (unfixed, and not instructor) version of the lab already has Stage 1 fixed. (I put an XSS into the street address as Tom, but it displays as ".script.". Was this on purpose? Am I missing something?

The XSS lab had a bug that was fixed but not released. If you build from master, it should work. I may be confusing XSS labs though. Also, the instructor stuff was;t ported. If you have it ported into the individual lessons please commit it back. If not, the team will eventually get to it. Let us known.

Thanks for the quick reply.

I did build from the latest src tree, pulled down fresh from github, FYI.

After diving through this in more detail, I think I can shed some light on what’s happening.

• The LAB: CrossSiteScripting Stage 1 is built from WebGoat-Lessons/goat-hills-financial… In that version of UpdateProfile.java, the http request is handled via a parser class, String address1 = s.getParser().getStringParameter(GoatHillsFinancial.ADDRESS1);

The parser class method, getStringParameter, converts “dangerous” characters like “<" and “>" into “.” Thus, the lab’s Stage 1 is already fixed, albeit not very well.

However, in the original still-broken Stage 1 lab, which can be found in WebGoat-Lessons/cross-site-sripting/… the UpdateProfile.java uses a simple HTTP Request to read the address1 string, String address1 = request.getParameter(CrossSiteScripting.ADDRESS1);

In prior versions of WebGoat, the students had to either us an in-line regex to validate address1 on input, or convert to the parser class and validate that way.

Clearly, it’s your call how to do this. I’m not questioning that. I’m merely pointing out that this is a pretty major departure from the prior LAB on XSS.

Also, I should point out that the old style code still resides out in WebGoat-Lessons/cross-site-scripting/… So, there are two versions of each of the lab java files floating around the src tree. That said, in WebGoat-Lessons/cross-site-scripting/…/CrossSiteScripting.java, the code is clearly using the versions in WebGoat-Lessons/goat-hills-financial as follows:

import org.owasp.webgoat.plugin.GoatHillsFinancial.DeleteProfile;
import org.owasp.webgoat.plugin.GoatHillsFinancial.EditProfile;
import org.owasp.webgoat.plugin.GoatHillsFinancial.FindProfile;
import org.owasp.webgoat.plugin.GoatHillsFinancial.GoatHillsFinancial;
import org.owasp.webgoat.plugin.GoatHillsFinancial.LessonAction;
import org.owasp.webgoat.plugin.GoatHillsFinancial.ListStaff;
import org.owasp.webgoat.plugin.GoatHillsFinancial.Login;
import org.owasp.webgoat.plugin.GoatHillsFinancial.Logout;
import org.owasp.webgoat.plugin.GoatHillsFinancial.SearchStaff;
import org.owasp.webgoat.plugin.GoatHillsFinancial.UpdateProfile;
import org.owasp.webgoat.plugin.GoatHillsFinancial.ViewProfile;

Just thought you should know. There are, of course, any number of ways to proceed, but I thought you should be aware of this.

Cheers,

Ken van Wyk

Renamed the classes, the classnames now reflect the lesson name so much less confusion

@krvw the instructions are again part of the lessons (see instructor packages in the Goathill labs)