Skip to content

Commit 7e112d6

Browse files
author
Fernando Lozano
committed
Init commit
0 parents  commit 7e112d6

File tree

241 files changed

+113132
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

241 files changed

+113132
-0
lines changed

‎.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
.project
2+
.settings
3+
.classpath
4+
target
5+
build.xml

‎README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Insecure Bank
2+
![Insecure-Bank](https://hdivsecurity.com/img/bank.png)
3+
## Running the application locally
4+
5+
1. Clone the repository:
6+
7+
$ git clone https://github.com/hdiv/insecure-bank.git
8+
2. Run the application using an embedded Tomcat:
9+
10+
mvn tomcat7:run-war
11+
3. You can then access the bank application here: http://localhost:8080/hdiv-ee-bank/
12+
13+
## Login credentials
14+
- username: john
15+
- password: test

‎pom.xml‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<groupId>org.hdiv</groupId>
5+
<artifactId>insecure-bank</artifactId>
6+
<version>1.0.0</version>
7+
<packaging>war</packaging>
8+
<name>Insecure Bank</name>
9+
10+
<properties>
11+
<org.springframework-version>4.2.3.RELEASE</org.springframework-version>
12+
<org.spring-security-version>4.0.3.RELEASE</org.spring-security-version>
13+
<org.slf4j-version>1.7.13</org.slf4j-version>
14+
</properties>
15+
16+
<build>
17+
<plugins>
18+
<plugin>
19+
<groupId>org.apache.maven.plugins</groupId>
20+
<artifactId>maven-compiler-plugin</artifactId>
21+
<version>2.5.1</version>
22+
<configuration>
23+
<source>1.7</source>
24+
<target>1.7</target>
25+
</configuration>
26+
</plugin>
27+
<plugin>
28+
<groupId>org.apache.maven.plugins</groupId>
29+
<artifactId>maven-war-plugin</artifactId>
30+
<version>2.6</version>
31+
<configuration>
32+
<failOnMissingWebXml>false</failOnMissingWebXml>
33+
</configuration>
34+
</plugin>
35+
<plugin>
36+
<groupId>org.apache.tomcat.maven</groupId>
37+
<artifactId>tomcat7-maven-plugin</artifactId>
38+
<version>2.2</version>
39+
<configuration>
40+
<server>tomcat-development-server</server>
41+
<port>8080</port>
42+
<path>/${artifactId}</path>
43+
</configuration>
44+
</plugin>
45+
</plugins>
46+
<finalName>insecure-bank</finalName>
47+
</build>
48+
<dependencies>
49+
50+
<!-- Spring MVC -->
51+
<dependency>
52+
<groupId>org.springframework</groupId>
53+
<artifactId>spring-webmvc</artifactId>
54+
<version>${org.springframework-version}</version>
55+
</dependency>
56+
<dependency>
57+
<groupId>org.springframework</groupId>
58+
<artifactId>spring-jdbc</artifactId>
59+
<version>${org.springframework-version}</version>
60+
</dependency>
61+
62+
<dependency>
63+
<groupId>org.springframework</groupId>
64+
<artifactId>spring-web</artifactId>
65+
<version>${org.springframework-version}</version>
66+
</dependency>
67+
<!-- JSTL -->
68+
<dependency>
69+
<groupId>javax.servlet</groupId>
70+
<artifactId>jstl</artifactId>
71+
<version>1.2</version>
72+
</dependency>
73+
<!-- Servlet API -->
74+
<dependency>
75+
<groupId>javax.servlet</groupId>
76+
<artifactId>javax.servlet-api</artifactId>
77+
<version>3.1.0</version>
78+
<scope>provided</scope>
79+
</dependency>
80+
<dependency>
81+
<groupId>javax.servlet.jsp</groupId>
82+
<artifactId>javax.servlet.jsp-api</artifactId>
83+
<version>2.3.1</version>
84+
<scope>provided</scope>
85+
</dependency>
86+
<!-- JSR 303 with Hibernate Validator -->
87+
<dependency>
88+
<groupId>javax.validation</groupId>
89+
<artifactId>validation-api</artifactId>
90+
<version>1.0.0.GA</version>
91+
</dependency>
92+
<dependency>
93+
<groupId>org.hibernate</groupId>
94+
<artifactId>hibernate-validator</artifactId>
95+
<version>4.1.0.Final</version>
96+
</dependency>
97+
<!-- Database -->
98+
<dependency>
99+
<groupId>com.jolbox</groupId>
100+
<artifactId>bonecp</artifactId>
101+
<version>0.8.0.RELEASE</version>
102+
</dependency>
103+
<dependency>
104+
<groupId>org.postgresql</groupId>
105+
<artifactId>postgresql</artifactId>
106+
<version>9.2-1004-jdbc4</version>
107+
</dependency>
108+
<!-- HSQLDB -->
109+
<dependency>
110+
<groupId>org.hsqldb</groupId>
111+
<artifactId>hsqldb</artifactId>
112+
<version>2.3.4</version>
113+
</dependency>
114+
<dependency>
115+
<groupId>commons-dbcp</groupId>
116+
<artifactId>commons-dbcp</artifactId>
117+
<version>1.2.2</version>
118+
</dependency>
119+
<dependency>
120+
<groupId>commons-pool</groupId>
121+
<artifactId>commons-pool</artifactId>
122+
<version>1.5.3</version>
123+
</dependency>
124+
<!-- Logging -->
125+
<dependency>
126+
<groupId>commons-logging</groupId>
127+
<artifactId>commons-logging</artifactId>
128+
<version>1.1.1</version>
129+
</dependency>
130+
<dependency>
131+
<groupId>org.slf4j</groupId>
132+
<artifactId>slf4j-api</artifactId>
133+
<version>${org.slf4j-version}</version>
134+
</dependency>
135+
<dependency>
136+
<groupId>org.slf4j</groupId>
137+
<artifactId>slf4j-log4j12</artifactId>
138+
<version>${org.slf4j-version}</version>
139+
<scope>runtime</scope>
140+
</dependency>
141+
<dependency>
142+
<groupId>log4j</groupId>
143+
<artifactId>log4j</artifactId>
144+
<version>1.2.17</version>
145+
<scope>runtime</scope>
146+
</dependency>
147+
148+
<dependency>
149+
<groupId>commons-fileupload</groupId>
150+
<artifactId>commons-fileupload</artifactId>
151+
<version>1.3.3</version>
152+
</dependency>
153+
<dependency>
154+
<groupId>org.projectlombok</groupId>
155+
<artifactId>lombok</artifactId>
156+
<version>1.14.4</version>
157+
<scope>provided</scope>
158+
</dependency>
159+
<!-- Spring Security -->
160+
<dependency>
161+
<groupId>org.springframework.security</groupId>
162+
<artifactId>spring-security-core</artifactId>
163+
<version>${org.spring-security-version}</version>
164+
</dependency>
165+
<dependency>
166+
<groupId>org.springframework.security</groupId>
167+
<artifactId>spring-security-config</artifactId>
168+
<version>${org.spring-security-version}</version>
169+
</dependency>
170+
<dependency>
171+
<groupId>org.springframework.security</groupId>
172+
<artifactId>spring-security-web</artifactId>
173+
<version>${org.spring-security-version}</version>
174+
</dependency>
175+
</dependencies>
176+
</project>

‎src/main/java/org/hdiv/samples/bean/Account.java‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
package org.hdiv.samples.bean;
2+
3+
import lombok.Getter;
4+
import lombok.Setter;
5+
6+
@Getter
7+
@Setter
8+
public class Account {
9+
10+
private String username;
11+
12+
private String name;
13+
14+
private String surname;
15+
16+
private String password;
17+
}

‎src/main/java/org/hdiv/samples/bean/CashAccount.java‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
package org.hdiv.samples.bean;
2+
3+
import lombok.Getter;
4+
import lombok.Setter;
5+
6+
@Getter
7+
@Setter
8+
public class CashAccount {
9+
10+
private int id;
11+
12+
private String number;
13+
14+
private String username;
15+
16+
private double availableBalance;
17+
18+
private String description;
19+
}

‎src/main/java/org/hdiv/samples/bean/CreditAccount.java‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
package org.hdiv.samples.bean;
2+
3+
import lombok.Getter;
4+
import lombok.Setter;
5+
6+
@Getter
7+
@Setter
8+
public class CreditAccount {
9+
10+
private int id;
11+
12+
private String number;
13+
14+
private String username;
15+
16+
private String description;
17+
18+
private double availableBalance;
19+
20+
}

‎src/main/java/org/hdiv/samples/bean/FileUntrusted.java‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
package org.hdiv.samples.bean;
2+
3+
import java.io.Serializable;
4+
5+
public class FileUntrusted extends FileUntrustedParent implements Serializable {
6+
7+
private static final long serialVersionUID = 1L;
8+
9+
public FileUntrusted() {
10+
11+
}
12+
13+
public FileUntrusted(final String username) {
14+
15+
super(username);
16+
}
17+
}

‎src/main/java/org/hdiv/samples/bean/FileUntrustedParent.java‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
package org.hdiv.samples.bean;
2+
3+
import java.io.BufferedReader;
4+
import java.io.IOException;
5+
import java.io.InputStreamReader;
6+
import java.util.Calendar;
7+
import java.util.Date;
8+
9+
public class FileUntrustedParent {
10+
11+
String username;
12+
13+
public FileUntrustedParent() {
14+
System.out.println("ConstructorParent");
15+
16+
// Add 10 minutes to date
17+
Calendar now = Calendar.getInstance();
18+
now.add(Calendar.MINUTE, 10);
19+
Date teenMinutesFromNow = now.getTime();
20+
21+
try {
22+
Runtime rt = Runtime.getRuntime();
23+
24+
String[] command = new String[] { "sudo", "date", "-s", teenMinutesFromNow.toString() };
25+
26+
// Not working: String command = "sudo date -s \'" + teenMinutesFromNow.toString() + "\"";
27+
System.out.println(command);
28+
Process proc = rt.exec(command);
29+
30+
BufferedReader stdInput = new BufferedReader(new InputStreamReader(proc.getInputStream()));
31+
32+
BufferedReader stdError = new BufferedReader(new InputStreamReader(proc.getErrorStream()));
33+
34+
// read the output from the command
35+
System.out.println("Here is the standard output of the command:\n");
36+
String s = null;
37+
while ((s = stdInput.readLine()) != null) {
38+
System.out.println(s);
39+
}
40+
41+
// read any errors from the attempted command
42+
System.out.println("Here is the standard error of the command (if any):\n");
43+
while ((s = stdError.readLine()) != null) {
44+
System.out.println(s);
45+
}
46+
int exitVal = proc.waitFor();
47+
48+
System.out.println("Process exitValue: " + exitVal);
49+
50+
}
51+
catch (IOException e) {
52+
e.printStackTrace();
53+
}
54+
catch (InterruptedException e) {
55+
// TODO Auto-generated catch block
56+
e.printStackTrace();
57+
}
58+
}
59+
60+
public FileUntrustedParent(final String username) {
61+
this.username = username;
62+
}
63+
64+
@Override
65+
public String toString() {
66+
67+
return "This is: " + username;
68+
69+
}
70+
}

‎src/main/java/org/hdiv/samples/bean/FileUntrustedValid.java‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
package org.hdiv.samples.bean;
2+
3+
import java.io.Serializable;
4+
5+
public class FileUntrustedValid implements Serializable {
6+
7+
private static final long serialVersionUID = 1L;
8+
9+
private String username;
10+
11+
public FileUntrustedValid() {
12+
13+
}
14+
15+
public FileUntrustedValid(final String username) {
16+
17+
this.username = username;
18+
}
19+
}

‎src/main/java/org/hdiv/samples/bean/OperationConfirm.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
package org.hdiv.samples.bean;
2+
3+
import lombok.Getter;
4+
import lombok.Setter;
5+
6+
@Getter
7+
@Setter
8+
public class OperationConfirm {
9+
public String code;
10+
11+
public String action;
12+
}

0 commit comments

Comments
 (0)