Strip to minimum, and run via embedded Jetty.

mark.george / jetty

Browse code Strip to minimum, and run via embedded Jetty. master
1 parent 2ef9d7c commit 1af6cef80d84a7ad6452afd473bdf6b8563dd357 Mark George authored on 6 Sep 2021

Patch

Showing 68 changed files

Ignore Space Show notes View .gitignore
/build/ /.nb-gradle/ .gradle .idea *.trace.db /build/ /.nb-gradle/ .gradle .idea

Ignore Space Show notes View build.gradle
plugins { id 'war' id 'application' } repositories { mavenCentral() } dependencies { providedCompile group: 'javax.servlet', name: 'javax.servlet-api', version: '4.0.1' // jetty 10 supports servlet 4 def jettyVer = "10.+" implementation group: 'org.eclipse.jetty', name: 'jetty-webapp', version: jettyVer implementation group: 'org.eclipse.jetty', name: 'jetty-annotations', version: jettyVer implementation group: 'org.eclipse.jetty', name: 'apache-jsp', version: jettyVer implementation group: 'org.eclipse.jetty', name: 'jetty-slf4j-impl', version: jettyVer implementation group: 'com.h2database', name: 'h2', version: '1.4.200' implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.2.5' } task deployWar(type: Copy) { into "${projectDir}/deploy" with war } clean { delete "${projectDir}/deploy" } war.dependsOn deployWar mainClassName = "Start" plugins { id 'war' } repositories { mavenCentral() } dependencies { providedCompile 'javax.servlet:javax.servlet-api:3.1.0' implementation group: 'com.h2database', name: 'h2', version: '1.4.200' implementation group: 'org.owasp.antisamy', name: 'antisamy', version: '1.5.7' } sourceCompatibility = 1.8 targetCompatibility = 1.8

Ignore Space Show notes View

build.gradle

Ignore Space Show notes View db/users.h2.db
Not supported

Ignore Space Show notes View deploy/META-INF/MANIFEST.MF 0 → 100644
Manifest-Version: 1.0

Ignore Space Show notes View deploy/WEB-INF/classes/Start.class 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/classes/dao/DbConnection.class 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/classes/servlets/BetterLoginServlet.class 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/classes/servlets/DodgyLoginServlet.class 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/jspf/menu.jspf 0 → 100644
<div id="menu"> <a href=".">Home</a> <a href="login.jsp">Log In</a> </div>

Ignore Space Show notes View deploy/WEB-INF/lib/apache-el-9.0.29.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/apache-jsp-10.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/apache-jsp-9.0.29.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/asm-9.1.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/asm-analysis-9.1.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/asm-commons-9.1.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/asm-tree-9.1.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/ecj-3.19.0.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/h2-1.4.200.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jakarta.annotation-api-1.3.5.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jakarta.transaction-api-1.3.2.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-annotations-10.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-http-10.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-io-10.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-jndi-10.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-plus-10.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-schemas-4.0.3.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-security-10.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-server-10.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-servlet-10.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-servlet-api-4.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-slf4j-impl-10.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-util-10.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-webapp-10.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/jetty-xml-10.0.6.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/logback-classic-1.2.5.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/logback-core-1.2.5.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/WEB-INF/lib/slf4j-api-2.0.0-alpha1.jar 0 → 100644
Not supported

Ignore Space Show notes View deploy/css/forms.css 0 → 100644
/* Two column form layout, with right aligned labels. This has been tested (using HTML4.01 strict) with: - Firefox 3 - 6, - IE 8 (earlier versions do NOT work) - Chrome 2 - 13 (WebKit) - Opera 10 - 11.5 If font family and size is fixed then the forms should look the same in all of the above browsers. The HTML to use this layout should use the following structure: <form> <fieldset> <legend>legend</legend> <label>Label 1:<input type="text"></label> <label>Label 2:<input type="text"></label> <button type="submit">Submit</button> </fieldset> </form> The labels surround the input components to ensure they stay together. Oversized labels will break the layout so resize the fieldsets to suit. Author: Mark George <mgeorge@infoscience.otago.ac.nz> / fieldset { width: 20em; / effective width of field set / padding: 10px; / padding to space the components from the fieldset border / padding-top: 0px; / IE counts the top of the legend as the top of the fieldset meaning backgound color also covers the legend. padding-top makes this effect worse so set it to 0. / } fieldset label, fieldset input, fieldset textarea, fieldset select { vertical-align: middle; / ensure labels and input components are vertically centred / margin-top: 4px; / add some spacing between form 'rows' / margin-bottom: 4px; / add some spacing between form 'rows' / } fieldset label { text-align: right; / align the label text right / display: block; / make the label represent a single row in the layout / } fieldset input, fieldset textarea, fieldset select { width: 150px; / width of the form components / margin-left: 5px; / add some spacing between the label and the component / } fieldset [type="submit"], fieldset [type="reset"] { margin: auto; / restore margin for submit/reset buttons / margin-top: 5px; / add some top margin to space submit button from rest of form / width: 100%; / make submit buttons full width */ }

Ignore Space Show notes View

deploy/css/forms.css 0 → 100644

Two column form layout, with right aligned labels.

This has been tested (using HTML4.01 strict) with:
    - Firefox 3 - 6,
    - IE 8 (earlier versions do NOT work)
    - Chrome 2 - 13 (WebKit)
    - Opera 10 - 11.5

If font family and size is fixed then the forms should look the same in all of
the above browsers.

The HTML to use this layout should use the following structure:

<form>
   <fieldset>
      <legend>legend</legend>
      <label>Label 1:<input type="text"></label>
      <label>Label 2:<input type="text"></label>
      <button type="submit">Submit</button>
   </fieldset>
</form>

The labels surround the input components to ensure they stay together.

Oversized labels will break the layout so resize the fieldsets to suit.

Author:  Mark George <mgeorge@infoscience.otago.ac.nz>

fieldset {
   width: 20em;      /* effective width of field set */
   padding: 10px;    /* padding to space the components from the fieldset border */
   padding-top: 0px; /* IE counts the top of the legend as the top of the fieldset meaning backgound color also covers the legend.  padding-top makes this effect worse so set it to 0. */
}

fieldset label, fieldset input, fieldset textarea, fieldset select {
   vertical-align: middle; /* ensure labels and input components are vertically centred */
   margin-top: 4px;        /* add some spacing between form 'rows' */
   margin-bottom: 4px;     /*  add some spacing between form 'rows' */
}

fieldset label {
   text-align: right;    /* align the label text right */
   display: block;       /* make the label represent a single row in the layout */
}

fieldset input, fieldset textarea, fieldset select {
   width: 150px;       /* width of the form components */
   margin-left: 5px;   /* add some spacing between the label and the component */
}

fieldset *[type="submit"], fieldset *[type="reset"] {
   margin: auto;     /* restore margin for submit/reset buttons */
   margin-top: 5px;  /* add some top margin to space submit button from rest of form */
   width: 100%;      /* make submit buttons full width */
}

Ignore Space Show notes View deploy/css/style.css 0 → 100644
@import url("forms.css"); /* import forms layout / body { background: rgb(60,60,60); font-family: Arial; font-size: 12pt; } h1 { background: black; color: white; padding: 5px; margin-left:-20px; margin-right:-20px; text-align: center; } #content { border:thick; border-style:solid; border-color:black; border-radius: 25px 25px 25px 25px; / CSS3 / background:rgb(210,210,210); margin-top:10pt; margin-left:auto; margin-right:auto; margin-top:50px; padding: 20px; width:90%; max-width:800px; } table { margin-left:auto; margin-right:auto; position:relative; border-style:none; border-collapse: collapse; width: 90%; } td, th { border:thin; border-width: 1px 0px 1px 0px; border-style: dotted; padding-left: 5px; padding-right: 5px; } th { text-align: left; } div#menu { text-align:center; } div#welcome { text-align: left; } div#images { margin:auto; text-align:center; } div#menu a { border: medium; border-style: solid; border-radius: 10px 10px 10px 10px; background: rgb(200,200,200); text-decoration: none; font-weight: bolder; color: black; padding: 5px; margin: 3px; } input#quantityToAdd { width:3em; margin-right: 10px; } / fieldset fonts/colors/margins / fieldset { border-color:silver; background:rgb(200,200,200); margin:auto; } fieldset legend { color:black; font-weight:bold; } / make input components change color when focused / /input[type="text"]:hover, textarea:hover, select:hover, input[type="password"]:hover, input[type="text"]:focus, textarea:focus, select:focus, input[type="password"]:focus { background-color:#ffff99; border-color:#999999; }/ / numeric table cells / table .currency, table .quantity { text-align:right; } / fieldset widths / fieldset#login { width:245px; } fieldset#createaccount { width:250px; } fieldset#quantitytobuy { width:245px; } img { /display: block;*/ margin: auto; }

Ignore Space Show notes View

deploy/css/style.css 0 → 100644

@import url("forms.css");  /* import forms layout */

body {
   background: rgb(60,60,60);
   font-family: Arial;
   font-size: 12pt;
}

h1 {
   background: black;
   color: white;
   padding: 5px;
   margin-left:-20px;
   margin-right:-20px;
   text-align: center;
}

#content {
   border:thick;
   border-style:solid;
   border-color:black;
   border-radius: 25px 25px 25px 25px;         /* CSS3 */
   background:rgb(210,210,210);
   margin-top:10pt;
   margin-left:auto;
   margin-right:auto;
   margin-top:50px;
   padding: 20px;
   width:90%;
   max-width:800px;
}

table {
   margin-left:auto;
   margin-right:auto;
   position:relative;
   border-style:none;
   border-collapse: collapse;
   width: 90%;
}

td, th {
   border:thin;
   border-width: 1px 0px 1px 0px;
   border-style: dotted;
   padding-left: 5px;
   padding-right: 5px;
}

th {
   text-align: left;
}

div#menu {
   text-align:center;
}

div#welcome {
   text-align: left;
}

div#images {
   margin:auto;
   text-align:center;
}

div#menu a {
   border: medium;
   border-style: solid;
   border-radius: 10px 10px 10px 10px;
   background: rgb(200,200,200);
   text-decoration: none;
   font-weight: bolder;
   color: black;
   padding: 5px;
   margin: 3px;
}

input#quantityToAdd {
   width:3em;
   margin-right: 10px;
}

/* fieldset fonts/colors/margins */

fieldset {
   border-color:silver;
   background:rgb(200,200,200);
   margin:auto;
}

fieldset legend {
   color:black;
   font-weight:bold;
}

/* make input components change color when focused */

/*input[type="text"]:hover, textarea:hover, select:hover, input[type="password"]:hover,
input[type="text"]:focus, textarea:focus, select:focus, input[type="password"]:focus {
   background-color:#ffff99;
   border-color:#999999;
}*/

/* numeric table cells */

table .currency, table .quantity {
  text-align:right;
}

/* fieldset widths */

fieldset#login {
   width:245px;
}

fieldset#createaccount {
   width:250px;
}

fieldset#quantitytobuy {
   width:245px;
}

img {
   /*display: block;*/
   margin: auto;
}

Ignore Space Show notes View deploy/fake-cat.png 0 → 100644

Ignore Space Show notes View deploy/fake-dog.png 0 → 100644

Ignore Space Show notes View deploy/index.jsp 0 → 100644
<%@page contentType="text/html" pageEncoding="UTF-8"%> <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site</title> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <h1>Welcome to our awesome web site!</h1> <div id="images"> <img width="250" src="fake-cat.png" alt="Image of cat"/> <img width="250" src="fake-dog.png" alt="Image of dog"/> </div> </div> </body> </html>

Ignore Space Show notes View

deploy/index.jsp 0 → 100644

Ignore Space Show notes View deploy/login.jsp 0 → 100644
<!DOCTYPE html> <!-- used to demonstrate data theft via SQL injection --> <html> <head> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site - Login</title> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <h1>Welcome to our awesome web site!</h1> <fieldset><legend>Login</legend> <% if ("fail".equals(request.getParameter("login"))) { %> <p>Log in attempt failed. Please try again.</p> <% } %> <form action="login" method="POST"> <label>Username: <input type="text" name="username"></label> <label>Password: <input type="password" name="password"></label> <input type="submit" value="Login"> </form> </fieldset> </div> </body> </html>

Ignore Space Show notes View

deploy/login.jsp 0 → 100644

Ignore Space Show notes View deploy/welcome.jsp 0 → 100644
<%@page contentType="text/html" pageEncoding="UTF-8"%> <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site</title> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <% String user = (String) session.getAttribute("user");%> <h1>Welcome back <%=user%></h1> <div id="images"> <img width="250" src="fake-cat.png" alt="Image of cat"/> <img width="250" src="fake-dog.png" alt="Image of dog"/> </div> </div> </body> </html>

Ignore Space Show notes View

deploy/welcome.jsp 0 → 100644

Show notes View src/main/java/GenerateHtmlHex.java 100644 → 0
import java.math.BigInteger; /* * To change this license header, choose License Headers in Project Properties. * To change this template file, choose Tools \| Templates * and open the template in the editor. / /* * * @author mark */ public class GenerateHtmlHex { public static void main(String[] args) { String plain = "<script>alert('Session timed out. Please log in to continue.');window.location='https://i.chzbgr.com/maxW500/4554986496/hF3327748/'</script>"; String hex = String.format("%040x", new BigInteger(1, plain.getBytes())); String htmlHex = hex.replaceAll("(..)", "\\%$1").toUpperCase(); System.out.println(htmlHex); } }

Show notes View

src/main/java/GenerateHtmlHex.java 100644 → 0

Ignore Space Show notes View src/main/java/Start.java 0 → 100644
import java.awt.Desktop; import java.net.URI; import java.sql.SQLException; import java.util.concurrent.CompletableFuture; import java.util.logging.Level; import java.util.logging.Logger; import org.eclipse.jetty.annotations.AnnotationConfiguration; import org.eclipse.jetty.plus.webapp.EnvConfiguration; import org.eclipse.jetty.plus.webapp.PlusConfiguration; import org.eclipse.jetty.server.Server; import org.eclipse.jetty.webapp.Configuration; import org.eclipse.jetty.webapp.FragmentConfiguration; import org.eclipse.jetty.webapp.MetaInfConfiguration; import org.eclipse.jetty.webapp.WebAppConfiguration; import org.eclipse.jetty.webapp.WebAppContext; import org.eclipse.jetty.webapp.WebInfConfiguration; import org.eclipse.jetty.webapp.WebXmlConfiguration; /** * * @author Mark George <mark.george@otago.ac.nz> */ public class Start { public static void main(String[] args) throws Exception { Server server = new Server(8080); WebAppContext context = new WebAppContext(); context.setResourceBase("deploy"); context.setConfigurations( new Configuration[]{ new AnnotationConfiguration(), new WebAppConfiguration(), new WebXmlConfiguration(), new WebInfConfiguration(), new PlusConfiguration(), new MetaInfConfiguration(), new FragmentConfiguration(), new EnvConfiguration() } ); CompletableFuture.runAsync(() -> { try { new org.h2.tools.Console().runTool("-web", "-tcp", "-browser", "-user", "sa", "-url", "jdbc:h2:./db/users;AUTO_SERVER=TRUE;IFEXISTS=TRUE"); } catch (SQLException ex) { Logger.getLogger(Start.class.getName()).log(Level.SEVERE, null, ex); } }); context.setContextPath("/"); context.setParentLoaderPriority(true); server.setHandler(context); server.start(); // h2 has a pretty comprehensive openBrowser method that seems more reliable than the Desktop.browse method org.h2.tools.Server.openBrowser("http://localhost:8080"); server.join(); } }

Ignore Space Show notes View

src/main/java/Start.java 0 → 100644

import java.awt.Desktop;
import java.net.URI;
import java.sql.SQLException;
import java.util.concurrent.CompletableFuture;
import java.util.logging.Level;
import java.util.logging.Logger;
import org.eclipse.jetty.annotations.AnnotationConfiguration;
import org.eclipse.jetty.plus.webapp.EnvConfiguration;
import org.eclipse.jetty.plus.webapp.PlusConfiguration;
import org.eclipse.jetty.server.Server;
import org.eclipse.jetty.webapp.Configuration;
import org.eclipse.jetty.webapp.FragmentConfiguration;
import org.eclipse.jetty.webapp.MetaInfConfiguration;
import org.eclipse.jetty.webapp.WebAppConfiguration;
import org.eclipse.jetty.webapp.WebAppContext;
import org.eclipse.jetty.webapp.WebInfConfiguration;
import org.eclipse.jetty.webapp.WebXmlConfiguration;

/**
 *
 * @author Mark George <mark.george@otago.ac.nz>
 */
public class Start {

public static void main(String[] args) throws Exception {

Server server = new Server(8080);

WebAppContext context = new WebAppContext();
		context.setResourceBase("deploy");
		context.setConfigurations(
				new Configuration[]{
					new AnnotationConfiguration(),
					new WebAppConfiguration(),
					new WebXmlConfiguration(),
					new WebInfConfiguration(),
					new PlusConfiguration(),
					new MetaInfConfiguration(),
					new FragmentConfiguration(),
					new EnvConfiguration()
				}
		);

CompletableFuture.runAsync(() -> {
			try {
				new org.h2.tools.Console().runTool("-web", "-tcp", "-browser", "-user", "sa", "-url", "jdbc:h2:./db/users;AUTO_SERVER=TRUE;IFEXISTS=TRUE");
			} catch (SQLException ex) {
				Logger.getLogger(Start.class.getName()).log(Level.SEVERE, null, ex);
			}
		});
		
		context.setContextPath("/");
		context.setParentLoaderPriority(true);
		server.setHandler(context);
		server.start();
		
		// h2 has a pretty comprehensive openBrowser method that seems more reliable than the Desktop.browse method
		org.h2.tools.Server.openBrowser("http://localhost:8080");
		
		server.join();

}

Ignore Space Show notes View src/main/java/dao/DbConnection.java 0 → 100644
package dao; import java.io.File; import java.sql.Connection; import java.sql.SQLException; import org.h2.jdbcx.JdbcConnectionPool; import javax.servlet.ServletContext; public class DbConnection { private static final String USERNAME = "sa"; private static final String PASSWORD = ""; private static JdbcConnectionPool pool; public static Connection getConnection(ServletContext ctx) { String path = ctx.getRealPath(File.separator); String uri = "jdbc:h2:file:"+path+"/../db/users;AUTO_SERVER=TRUE;IFEXISTS=true"; System.out.println(uri); if (pool == null) { pool = JdbcConnectionPool.create(uri, USERNAME, PASSWORD); } try { return pool.getConnection(); } catch (SQLException ex) { throw new RuntimeException(ex); } } }

Ignore Space Show notes View

src/main/java/dao/DbConnection.java 0 → 100644

Show notes View src/main/java/dao/JdbcConnection.java 100644 → 0
package dao; import java.io.File; import java.sql.Connection; import java.sql.SQLException; import org.h2.jdbcx.JdbcConnectionPool; import javax.servlet.ServletContext; public class JdbcConnection { private static final String USERNAME = "sa"; private static final String PASSWORD = ""; private static JdbcConnectionPool pool; public static Connection getConnection(ServletContext ctx) { String path = ctx.getRealPath(File.separator); String uri = "jdbc:h2:file:"+path+"db/users;AUTO_SERVER=TRUE;IFEXISTS=true"; System.out.println(uri); if (pool == null) { pool = JdbcConnectionPool.create(uri, USERNAME, PASSWORD); } try { return pool.getConnection(); } catch (SQLException ex) { throw new RuntimeException(ex); } } }

Show notes View

src/main/java/dao/JdbcConnection.java 100644 → 0

Show notes View src/main/java/servlets/AwesomeLoginServlet.java 100644 → 0
/* * To change this template, choose Tools \| Templates * and open the template in the editor. / package servlets; import dao.JdbcConnection; import java.io.IOException; import java.sql.Connection; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import java.util.logging.Level; import java.util.logging.Logger; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; /* * * This servlet is used to demonstrate SQL injection attacks. * * * @author mark / @WebServlet(name="AwesomeLoginServlet", urlPatterns = {"/awesomelogin"}) public class AwesomeLoginServlet extends HttpServlet { /* * Processes requests for both HTTP * <code>GET</code> and * <code>POST</code> methods. * * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs / protected void processRequest(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { response.setContentType("text/html;charset=UTF-8"); String username = request.getParameter("username"); String password = request.getParameter("password"); String sql = "select name from users where username = '" + username + "' and password = '" + password + "';"; System.out.println(sql); try ( Connection con = JdbcConnection.getConnection(getServletContext()); Statement s = con.createStatement(); ResultSet rs = s.executeQuery(sql); ) { if (rs.next()) { String result = rs.getString("name"); request.getSession().setAttribute("user", result); response.sendRedirect("welcome.jsp"); } else { response.sendRedirect("awesome_login.jsp?login=fail"); } } catch (SQLException ex) { Logger.getLogger(LoginServlet.class.getName()).log(Level.SEVERE, null, ex); } } // <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code."> /* * Handles the HTTP * <code>GET</code> method. * * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs / @Override protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { processRequest(request, response); } /* * Handles the HTTP <code>POST</code> method. * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs / @Override protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { processRequest(request, response); } /* * Returns a short description of the servlet. * @return a String containing servlet description */ @Override public String getServletInfo() { return "Short description"; }// </editor-fold> }

Show notes View

src/main/java/servlets/AwesomeLoginServlet.java 100644 → 0

/*
 * To change this template, choose Tools | Templates
 * and open the template in the editor.
 */
package servlets;

import dao.JdbcConnection;
import java.io.IOException;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 *
 * This servlet is used to demonstrate SQL injection attacks.
 *
 *
 * @author mark
 */
@WebServlet(name="AwesomeLoginServlet", urlPatterns = {"/awesomelogin"})
public class AwesomeLoginServlet extends HttpServlet {

/**
    * Processes requests for both HTTP
    * <code>GET</code> and
    * <code>POST</code> methods.
    *
    * @param request servlet request
    * @param response servlet response
    * @throws ServletException if a servlet-specific error occurs
    * @throws IOException if an I/O error occurs
    */
   protected void processRequest(HttpServletRequest request, HttpServletResponse response)
      throws ServletException, IOException {
      response.setContentType("text/html;charset=UTF-8");

String username = request.getParameter("username");
      String password = request.getParameter("password");

String sql = "select name from users where username = '" + username + "' and password = '" + password + "';";
		System.out.println(sql);
		
      try (
         Connection con = JdbcConnection.getConnection(getServletContext());
         Statement s = con.createStatement();
         ResultSet rs = s.executeQuery(sql);
         ) {

if (rs.next()) {
				String result = rs.getString("name");
				request.getSession().setAttribute("user", result);
				response.sendRedirect("welcome.jsp");
         } else {
				response.sendRedirect("awesome_login.jsp?login=fail");
			}

} catch (SQLException ex) {
         Logger.getLogger(LoginServlet.class.getName()).log(Level.SEVERE, null, ex);
      }
   }
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
/**
 * Handles the HTTP
 * <code>GET</code> method.
 *
 * @param request servlet request
 * @param response servlet response
 * @throws ServletException if a servlet-specific error occurs
 * @throws IOException if an I/O error occurs
 */
@Override
   protected void doGet(HttpServletRequest request, HttpServletResponse response)
	   throws ServletException, IOException {
		processRequest(request, response);
	}

/**
	 * Handles the HTTP <code>POST</code> method.
	 * @param request servlet request
	 * @param response servlet response
	 * @throws ServletException if a servlet-specific error occurs
	 * @throws IOException if an I/O error occurs
	 */
	@Override
   protected void doPost(HttpServletRequest request, HttpServletResponse response)
	   throws ServletException, IOException {
		processRequest(request, response);
	}

/**
	 * Returns a short description of the servlet.
	 * @return a String containing servlet description
	 */
	@Override
   public String getServletInfo() {
		return "Short description";
	}// </editor-fold>
}

Ignore Space Show notes View

src/main/java/servlets/BetterLoginServlet.java 0 → 100644

package servlets;

import dao.DbConnection;
import java.io.IOException;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

//@WebServlet(urlPatterns = {"/login"})
public class BetterLoginServlet extends HttpServlet {

@Override
	protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

String username = request.getParameter("username");
		String password = request.getParameter("password");

String sql = "select name from users where username = ? and password = ?;";

try (
			Connection con = DbConnection.getConnection(getServletContext());
			PreparedStatement stmt = con.prepareStatement(sql);
			) {

stmt.setString(1, username);
			stmt.setString(2, password);

ResultSet rs = stmt.executeQuery(sql);

if (rs.next()) {
				String result = rs.getString("name");
				request.getSession().setAttribute("user", result);
				response.sendRedirect("welcome.jsp");
			} else {
				response.sendRedirect("login.jsp?login=fail");
			}

} catch (SQLException ex) {
			Logger.getLogger(BetterLoginServlet.class.getName()).log(Level.SEVERE, null, ex);
		}
	}

}

Ignore Space Show notes View

src/main/java/servlets/DodgyLoginServlet.java 0 → 100644

package servlets;

import dao.DbConnection;
import java.io.IOException;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

@WebServlet(urlPatterns = {"/login"})
public class DodgyLoginServlet extends HttpServlet {

@Override
	protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

String username = request.getParameter("username");
		String password = request.getParameter("password");

String sql = "select name from users where username = '" + username + "' and password = '" + password + "';";

System.out.println(sql);

try (
			Connection con = DbConnection.getConnection(getServletContext());
			Statement s = con.createStatement();
			) {

ResultSet rs = s.executeQuery(sql);

if (rs.next()) {
				String result = rs.getString("name");
				request.getSession().setAttribute("user", result);
				response.sendRedirect("welcome.jsp");
			} else {
				response.sendRedirect("login.jsp?login=fail");
			}

} catch (SQLException ex) {
			Logger.getLogger(DodgyLoginServlet.class.getName()).log(Level.SEVERE, null, ex);
		}
	}

}

Show notes View

src/main/java/servlets/LoginServlet.java 100644 → 0

/*
 * To change this template, choose Tools | Templates
 * and open the template in the editor.
 */
package servlets;

import dao.JdbcConnection;
import java.io.IOException;
import java.io.PrintWriter;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 *
 * This servlet is used to demonstrate SQL injection attacks.
 *
 *
 * @author mark
 */
@WebServlet(name = "LoginServlet", urlPatterns = {"/login"})
public class LoginServlet extends HttpServlet {

/**
	 * Processes requests for both HTTP <code>GET</code> and <code>POST</code>
	 * methods.
	 *
	 * @param request servlet request
	 * @param response servlet response
	 * @throws ServletException if a servlet-specific error occurs
	 * @throws IOException if an I/O error occurs
	 */
	protected void processRequest(HttpServletRequest request, HttpServletResponse response)
			  throws ServletException, IOException {

response.setContentType("text/html;charset=UTF-8");
		PrintWriter out = response.getWriter();

String username = request.getParameter("username");
		String password = request.getParameter("password");

String sql = "select * from users where username = '" + username + "' and password = '" + password + "';";
		try (
				  Connection con = JdbcConnection.getConnection(getServletContext());
				  Statement s = con.createStatement();
				  ResultSet rs = s.executeQuery(sql);) {

if (rs.next()) {
				String uname = rs.getString("name");
				out.println("<!DOCTYPE html>");
				out.println("<html>");

out.println("<head>");
				out.println("<link rel=\"stylesheet\" href=\"highlight.js/github.css\">");
				out.println("<script src=\"highlight.js/highlight.pack.js\"></script>");
				out.println("<script>hljs.initHighlightingOnLoad();</script>");
				out.println("</head>");

out.println("<body>");
				out.println("<h1 style=\"color: green;\">Hi " + uname + ".  You have successfully logged in!</h1>");
				out.println("<p>Code for generating query:</p>");
				out.println("<pre><code class=\"java\">\"select * from users where username = '\" + username + \"' and password = '\" + password + \"';\"</code></pre>");
				out.println("<p>Generated query was:</p>");
				out.println("<pre><code class=\"sql\">" + sql + "</code></pre>");
				out.println("<p>Query found a matching result.</p>");
				out.println("<p><a href=\"index.jsp\">Back</a></p>");
				out.println("</body></html>");
			} else {
				out.println("<!DOCTYPE html>");
				out.println("<html>");

out.println("<body>");
				out.println("<h1 style=\"color: red;\">Log in failed!</h1>");
				out.println("<p>Code for generating query:</p>");
				out.println("<pre><code class=\"java\">\"select * from users where username = '\" + username + \"' and password = '\" + password + \"';\"</code></pre>");
				out.println("<p>Generated query was:</p>");
				out.println("<pre><code class=\"sql\">" + sql + "</code></pre>");
				out.println("<p>Query found no results matching those details.</p>");
				out.println("<p><a href=\"index.jsp\">Back</a></p>");
				out.println("</body></html>");
			}

/**
	 * Handles the HTTP <code>GET</code> method.
	 *
	 * @param request servlet request
	 * @param response servlet response
	 * @throws ServletException if a servlet-specific error occurs
	 * @throws IOException if an I/O error occurs
	 */
	@Override
	protected void doGet(HttpServletRequest request, HttpServletResponse response)
			  throws ServletException, IOException {
		processRequest(request, response);
	}

/**
	 * Handles the HTTP <code>POST</code> method.
	 *
	 * @param request servlet request
	 * @param response servlet response
	 * @throws ServletException if a servlet-specific error occurs
	 * @throws IOException if an I/O error occurs
	 */
	@Override
	protected void doPost(HttpServletRequest request, HttpServletResponse response)
			  throws ServletException, IOException {
		processRequest(request, response);
	}

/**
	 * Returns a short description of the servlet.
	 *
	 * @return a String containing servlet description
	 */
	@Override
	public String getServletInfo() {
		return "Short description";
	}// </editor-fold>
}

Ignore Space Show notes View src/main/webapp/WEB-INF/jspf/menu.jspf
<div id="menu"> <a href=".">Home</a> <a href="login.jsp">Log In</a> </div> <div id="menu"> <a href=".">Home</a> <a href="awesome_login.jsp">Log In</a> <a href="login.jsp">Other Log In</a> <a href="create-account.jsp">Create Account</a> <a href="search.jsp">Search</a> <a href="safe_search.jsp">Safe Search</a> </div>

Show notes View src/main/webapp/antisamy.xml 100644 → 0
<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="antisamy.xsd"> <directives> <directive name="onUnknownTag" value="encode" /> </directives> </anti-samy-rules>

Show notes View

src/main/webapp/awesome_login.jsp 100644 → 0

Show notes View

src/main/webapp/create-account.jsp 100644 → 0

Show notes View

src/main/webapp/create-account_1.jsp 100644 → 0

Show notes View

src/main/webapp/herephishyphishy.jsp 100644 → 0

Show notes View

src/main/webapp/highlight.js/github.css 100644 → 0

github.com style (c) Vasily Polovnyov <vast@whiteants.net>

.hljs {
  display: block;
  overflow-x: auto;
  padding: 0.5em;
  color: #333;
  background: #f8f8f8;
}

.hljs-comment,
.hljs-quote {
  color: #998;
  font-style: italic;
}

.hljs-keyword,
.hljs-selector-tag,
.hljs-subst {
  color: #333;
  font-weight: bold;
}

.hljs-number,
.hljs-literal,
.hljs-variable,
.hljs-template-variable,
.hljs-tag .hljs-attr {
  color: #008080;
}

.hljs-string,
.hljs-doctag {
  color: #d14;
}

.hljs-title,
.hljs-section,
.hljs-selector-id {
  color: #900;
  font-weight: bold;
}

.hljs-subst {
  font-weight: normal;
}

.hljs-type,
.hljs-class .hljs-title {
  color: #458;
  font-weight: bold;
}

.hljs-tag,
.hljs-name,
.hljs-attribute {
  color: #000080;
  font-weight: normal;
}

.hljs-regexp,
.hljs-link {
  color: #009926;
}

.hljs-symbol,
.hljs-bullet {
  color: #990073;
}

.hljs-built_in,
.hljs-builtin-name {
  color: #0086b3;
}

.hljs-meta {
  color: #999;
  font-weight: bold;
}

.hljs-deletion {
  background: #fdd;
}

.hljs-addition {
  background: #dfd;
}

.hljs-emphasis {
  font-style: italic;
}

.hljs-strong {
  font-weight: bold;
}

Show notes View

src/main/webapp/highlight.js/highlight.pack.js 100644 → 0

/*! highlight.js v9.7.0 | BSD3 License | git.io/hljslicense */
!function(e){var n="object"==typeof window&&window||"object"==typeof self&&self;"undefined"!=typeof exports?e(exports):n&&(n.hljs=e({}),"function"==typeof define&&define.amd&&define([],function(){return n.hljs}))}(function(e){function n(e){return e.replace(/[&<>]/gm,function(e){return I[e]})}function t(e){return e.nodeName.toLowerCase()}function r(e,n){var t=e&&e.exec(n);return t&&0===t.index}function a(e){return k.test(e)}function i(e){var n,t,r,i,o=e.className+" ";if(o+=e.parentNode?e.parentNode.className:"",t=B.exec(o))return R(t[1])?t[1]:"no-highlight";for(o=o.split(/\s+/),n=0,r=o.length;r>n;n++)if(i=o[n],a(i)||R(i))return i}function o(e,n){var t,r={};for(t in e)r[t]=e[t];if(n)for(t in n)r[t]=n[t];return r}function u(e){var n=[];return function r(e,a){for(var i=e.firstChild;i;i=i.nextSibling)3===i.nodeType?a+=i.nodeValue.length:1===i.nodeType&&(n.push({event:"start",offset:a,node:i}),a=r(i,a),t(i).match(/br|hr|img|input/)||n.push({event:"stop",offset:a,node:i}));return a}(e,0),n}function c(e,r,a){function i(){return e.length&&r.length?e[0].offset!==r[0].offset?e[0].offset<r[0].offset?e:r:"start"===r[0].event?e:r:e.length?e:r}function o(e){function r(e){return" "+e.nodeName+'="'+n(e.value)+'"'}l+="<"+t(e)+w.map.call(e.attributes,r).join("")+">"}function u(e){l+="</"+t(e)+">"}function c(e){("start"===e.event?o:u)(e.node)}for(var s=0,l="",f=[];e.length||r.length;){var g=i();if(l+=n(a.substr(s,g[0].offset-s)),s=g[0].offset,g===e){f.reverse().forEach(u);do c(g.splice(0,1)[0]),g=i();while(g===e&&g.length&&g[0].offset===s);f.reverse().forEach(o)}else"start"===g[0].event?f.push(g[0].node):f.pop(),c(g.splice(0,1)[0])}return l+n(a.substr(s))}function s(e){function n(e){return e&&e.source||e}function t(t,r){return new RegExp(n(t),"m"+(e.cI?"i":"")+(r?"g":""))}function r(a,i){if(!a.compiled){if(a.compiled=!0,a.k=a.k||a.bK,a.k){var u={},c=function(n,t){e.cI&&(t=t.toLowerCase()),t.split(" ").forEach(function(e){var t=e.split("|");u[t[0]]=[n,t[1]?Number(t[1]):1]})};"string"==typeof a.k?c("keyword",a.k):E(a.k).forEach(function(e){c(e,a.k[e])}),a.k=u}a.lR=t(a.l||/\w+/,!0),i&&(a.bK&&(a.b="\\b("+a.bK.split(" ").join("|")+")\\b"),a.b||(a.b=/\B|\b/),a.bR=t(a.b),a.e||a.eW||(a.e=/\B|\b/),a.e&&(a.eR=t(a.e)),a.tE=n(a.e)||"",a.eW&&i.tE&&(a.tE+=(a.e?"|":"")+i.tE)),a.i&&(a.iR=t(a.i)),null==a.r&&(a.r=1),a.c||(a.c=[]);var s=[];a.c.forEach(function(e){e.v?e.v.forEach(function(n){s.push(o(e,n))}):s.push("self"===e?a:e)}),a.c=s,a.c.forEach(function(e){r(e,a)}),a.starts&&r(a.starts,i);var l=a.c.map(function(e){return e.bK?"\\.?("+e.b+")\\.?":e.b}).concat([a.tE,a.i]).map(n).filter(Boolean);a.t=l.length?t(l.join("|"),!0):{exec:function(){return null}}}}r(e)}function l(e,t,a,i){function o(e,n){var t,a;for(t=0,a=n.c.length;a>t;t++)if(r(n.c[t].bR,e))return n.c[t]}function u(e,n){if(r(e.eR,n)){for(;e.endsParent&&e.parent;)e=e.parent;return e}return e.eW?u(e.parent,n):void 0}function c(e,n){return!a&&r(n.iR,e)}function g(e,n){var t=N.cI?n[0].toLowerCase():n[0];return e.k.hasOwnProperty(t)&&e.k[t]}function h(e,n,t,r){var a=r?"":y.classPrefix,i='<span class="'+a,o=t?"":C;return i+=e+'">',i+n+o}function p(){var e,t,r,a;if(!E.k)return n(B);for(a="",t=0,E.lR.lastIndex=0,r=E.lR.exec(B);r;)a+=n(B.substr(t,r.index-t)),e=g(E,r),e?(M+=e[1],a+=h(e[0],n(r[0]))):a+=n(r[0]),t=E.lR.lastIndex,r=E.lR.exec(B);return a+n(B.substr(t))}function d(){var e="string"==typeof E.sL;if(e&&!x[E.sL])return n(B);var t=e?l(E.sL,B,!0,L[E.sL]):f(B,E.sL.length?E.sL:void 0);return E.r>0&&(M+=t.r),e&&(L[E.sL]=t.top),h(t.language,t.value,!1,!0)}function b(){k+=null!=E.sL?d():p(),B=""}function v(e){k+=e.cN?h(e.cN,"",!0):"",E=Object.create(e,{parent:{value:E}})}function m(e,n){if(B+=e,null==n)return b(),0;var t=o(n,E);if(t)return t.skip?B+=n:(t.eB&&(B+=n),b(),t.rB||t.eB||(B=n)),v(t,n),t.rB?0:n.length;var r=u(E,n);if(r){var a=E;a.skip?B+=n:(a.rE||a.eE||(B+=n),b(),a.eE&&(B=n));do E.cN&&(k+=C),E.skip||(M+=E.r),E=E.parent;while(E!==r.parent);return r.starts&&v(r.starts,""),a.rE?0:n.length}if(c(n,E))throw new Error('Illegal lexeme "'+n+'" for mode "'+(E.cN||"<unnamed>")+'"');return B+=n,n.length||1}var N=R(e);if(!N)throw new Error('Unknown language: "'+e+'"');s(N);var w,E=i||N,L={},k="";for(w=E;w!==N;w=w.parent)w.cN&&(k=h(w.cN,"",!0)+k);var B="",M=0;try{for(var I,j,O=0;;){if(E.t.lastIndex=O,I=E.t.exec(t),!I)break;j=m(t.substr(O,I.index-O),I[0]),O=I.index+j}for(m(t.substr(O)),w=E;w.parent;w=w.parent)w.cN&&(k+=C);return{r:M,value:k,language:e,top:E}}catch(T){if(T.message&&-1!==T.message.indexOf("Illegal"))return{r:0,value:n(t)};throw T}}function f(e,t){t=t||y.languages||E(x);var r={r:0,value:n(e)},a=r;return t.filter(R).forEach(function(n){var t=l(n,e,!1);t.language=n,t.r>a.r&&(a=t),t.r>r.r&&(a=r,r=t)}),a.language&&(r.second_best=a),r}function g(e){return y.tabReplace||y.useBR?e.replace(M,function(e,n){return y.useBR&&"\n"===e?"<br>":y.tabReplace?n.replace(/\t/g,y.tabReplace):void 0}):e}function h(e,n,t){var r=n?L[n]:t,a=[e.trim()];return e.match(/\bhljs\b/)||a.push("hljs"),-1===e.indexOf(r)&&a.push(r),a.join(" ").trim()}function p(e){var n,t,r,o,s,p=i(e);a(p)||(y.useBR?(n=document.createElementNS("http://www.w3.org/1999/xhtml","div"),n.innerHTML=e.innerHTML.replace(/\n/g,"").replace(/<br[ \/]*>/g,"\n")):n=e,s=n.textContent,r=p?l(p,s,!0):f(s),t=u(n),t.length&&(o=document.createElementNS("http://www.w3.org/1999/xhtml","div"),o.innerHTML=r.value,r.value=c(t,u(o),s)),r.value=g(r.value),e.innerHTML=r.value,e.className=h(e.className,p,r.language),e.result={language:r.language,re:r.r},r.second_best&&(e.second_best={language:r.second_best.language,re:r.second_best.r}))}function d(e){y=o(y,e)}function b(){if(!b.called){b.called=!0;var e=document.querySelectorAll("pre code");w.forEach.call(e,p)}}function v(){addEventListener("DOMContentLoaded",b,!1),addEventListener("load",b,!1)}function m(n,t){var r=x[n]=t(e);r.aliases&&r.aliases.forEach(function(e){L[e]=n})}function N(){return E(x)}function R(e){return e=(e||"").toLowerCase(),x[e]||x[L[e]]}var w=[],E=Object.keys,x={},L={},k=/^(no-?highlight|plain|text)$/i,B=/\blang(?:uage)?-([\w-]+)\b/i,M=/((^(<[^>]+>|\t|)+|(?:\n)))/gm,C="</span>",y={classPrefix:"hljs-",tabReplace:null,useBR:!1,languages:void 0},I={"&":"&amp;","<":"&lt;",">":"&gt;"};return e.highlight=l,e.highlightAuto=f,e.fixMarkup=g,e.highlightBlock=p,e.configure=d,e.initHighlighting=b,e.initHighlightingOnLoad=v,e.registerLanguage=m,e.listLanguages=N,e.getLanguage=R,e.inherit=o,e.IR="[a-zA-Z]\\w*",e.UIR="[a-zA-Z_]\\w*",e.NR="\\b\\d+(\\.\\d+)?",e.CNR="(-?)(\\b0[xX][a-fA-F0-9]+|(\\b\\d+(\\.\\d*)?|\\.\\d+)([eE][-+]?\\d+)?)",e.BNR="\\b(0b[01]+)",e.RSR="!|!=|!==|%|%=|&|&&|&=|\\*|\\*=|\\+|\\+=|,|-|-=|/=|/|:|;|<<|<<=|<=|<|===|==|=|>>>=|>>=|>=|>>>|>>|>|\\?|\\[|\\{|\\(|\\^|\\^=|\\||\\|=|\\|\\||~",e.BE={b:"\\\\[\\s\\S]",r:0},e.ASM={cN:"string",b:"'",e:"'",i:"\\n",c:[e.BE]},e.QSM={cN:"string",b:'"',e:'"',i:"\\n",c:[e.BE]},e.PWM={b:/\b(a|an|the|are|I'm|isn't|don't|doesn't|won't|but|just|should|pretty|simply|enough|gonna|going|wtf|so|such|will|you|your|like)\b/},e.C=function(n,t,r){var a=e.inherit({cN:"comment",b:n,e:t,c:[]},r||{});return a.c.push(e.PWM),a.c.push({cN:"doctag",b:"(?:TODO|FIXME|NOTE|BUG|XXX):",r:0}),a},e.CLCM=e.C("//","$"),e.CBCM=e.C("/\\*","\\*/"),e.HCM=e.C("#","$"),e.NM={cN:"number",b:e.NR,r:0},e.CNM={cN:"number",b:e.CNR,r:0},e.BNM={cN:"number",b:e.BNR,r:0},e.CSSNM={cN:"number",b:e.NR+"(%|em|ex|ch|rem|vw|vh|vmin|vmax|cm|mm|in|pt|pc|px|deg|grad|rad|turn|s|ms|Hz|kHz|dpi|dpcm|dppx)?",r:0},e.RM={cN:"regexp",b:/\//,e:/\/[gimuy]*/,i:/\n/,c:[e.BE,{b:/\[/,e:/\]/,r:0,c:[e.BE]}]},e.TM={cN:"title",b:e.IR,r:0},e.UTM={cN:"title",b:e.UIR,r:0},e.METHOD_GUARD={b:"\\.\\s*"+e.UIR,r:0},e});hljs.registerLanguage("sql",function(e){var t=e.C("--","$");return{cI:!0,i:/[<>{}*#]/,c:[{bK:"begin end start commit rollback savepoint lock alter create drop rename call delete do handler insert load replace select truncate update set show pragma grant merge describe use explain help declare prepare execute deallocate release unlock purge reset change stop analyze cache flush optimize repair kill install uninstall checksum restore check backup revoke comment",e:/;/,eW:!0,l:/[\w\.]+/,k:{keyword:"abort abs absolute acc acce accep accept access accessed accessible account acos action activate add addtime admin administer advanced advise aes_decrypt aes_encrypt after agent aggregate ali alia alias allocate allow alter always analyze ancillary and any anydata anydataset anyschema anytype apply archive archived archivelog are as asc ascii asin assembly assertion associate asynchronous at atan atn2 attr attri attrib attribu attribut attribute attributes audit authenticated authentication authid authors auto autoallocate autodblink autoextend automatic availability avg backup badfile basicfile before begin beginning benchmark between bfile bfile_base big bigfile bin binary_double binary_float binlog bit_and bit_count bit_length bit_or bit_xor bitmap blob_base block blocksize body both bound buffer_cache buffer_pool build bulk by byte byteordermark bytes cache caching call calling cancel capacity cascade cascaded case cast catalog category ceil ceiling chain change changed char_base char_length character_length characters characterset charindex charset charsetform charsetid check checksum checksum_agg child choose chr chunk class cleanup clear client clob clob_base clone close cluster_id cluster_probability cluster_set clustering coalesce coercibility col collate collation collect colu colum column column_value columns columns_updated comment commit compact compatibility compiled complete composite_limit compound compress compute concat concat_ws concurrent confirm conn connec connect connect_by_iscycle connect_by_isleaf connect_by_root connect_time connection consider consistent constant constraint constraints constructor container content contents context contributors controlfile conv convert convert_tz corr corr_k corr_s corresponding corruption cos cost count count_big counted covar_pop covar_samp cpu_per_call cpu_per_session crc32 create creation critical cross cube cume_dist curdate current current_date current_time current_timestamp current_user cursor curtime customdatum cycle data database databases datafile datafiles datalength date_add date_cache date_format date_sub dateadd datediff datefromparts datename datepart datetime2fromparts day day_to_second dayname dayofmonth dayofweek dayofyear days db_role_change dbtimezone ddl deallocate declare decode decompose decrement decrypt deduplicate def defa defau defaul default defaults deferred defi defin define degrees delayed delegate delete delete_all delimited demand dense_rank depth dequeue des_decrypt des_encrypt des_key_file desc descr descri describ describe descriptor deterministic diagnostics difference dimension direct_load directory disable disable_all disallow disassociate discardfile disconnect diskgroup distinct distinctrow distribute distributed div do document domain dotnet double downgrade drop dumpfile duplicate duration each edition editionable editions element ellipsis else elsif elt empty enable enable_all enclosed encode encoding encrypt end end-exec endian enforced engine engines enqueue enterprise entityescaping eomonth error errors escaped evalname evaluate event eventdata events except exception exceptions exchange exclude excluding execu execut execute exempt exists exit exp expire explain export export_set extended extent external external_1 external_2 externally extract failed failed_login_attempts failover failure far fast feature_set feature_value fetch field fields file file_name_convert filesystem_like_logging final finish first first_value fixed flash_cache flashback floor flush following follows for forall force form forma format found found_rows freelist freelists freepools fresh from from_base64 from_days ftp full function general generated get get_format get_lock getdate getutcdate global global_name globally go goto grant grants greatest group group_concat group_id grouping grouping_id groups gtid_subtract guarantee guard handler hash hashkeys having hea head headi headin heading heap help hex hierarchy high high_priority hosts hour http id ident_current ident_incr ident_seed identified identity idle_time if ifnull ignore iif ilike ilm immediate import in include including increment index indexes indexing indextype indicator indices inet6_aton inet6_ntoa inet_aton inet_ntoa infile initial initialized initially initrans inmemory inner innodb input insert install instance instantiable instr interface interleaved intersect into invalidate invisible is is_free_lock is_ipv4 is_ipv4_compat is_not is_not_null is_used_lock isdate isnull isolation iterate java join json json_exists keep keep_duplicates key keys kill language large last last_day last_insert_id last_value lax lcase lead leading least leaves left len lenght length less level levels library like like2 like4 likec limit lines link list listagg little ln load load_file lob lobs local localtime localtimestamp locate locator lock locked log log10 log2 logfile logfiles logging logical logical_reads_per_call logoff logon logs long loop low low_priority lower lpad lrtrim ltrim main make_set makedate maketime managed management manual map mapping mask master master_pos_wait match matched materialized max maxextents maximize maxinstances maxlen maxlogfiles maxloghistory maxlogmembers maxsize maxtrans md5 measures median medium member memcompress memory merge microsecond mid migration min minextents minimum mining minus minute minvalue missing mod mode model modification modify module monitoring month months mount move movement multiset mutex name name_const names nan national native natural nav nchar nclob nested never new newline next nextval no no_write_to_binlog noarchivelog noaudit nobadfile nocheck nocompress nocopy nocycle nodelay nodiscardfile noentityescaping noguarantee nokeep nologfile nomapping nomaxvalue nominimize nominvalue nomonitoring none noneditionable nonschema noorder nopr nopro noprom nopromp noprompt norely noresetlogs noreverse normal norowdependencies noschemacheck noswitch not nothing notice notrim novalidate now nowait nth_value nullif nulls num numb numbe nvarchar nvarchar2 object ocicoll ocidate ocidatetime ociduration ociinterval ociloblocator ocinumber ociref ocirefcursor ocirowid ocistring ocitype oct octet_length of off offline offset oid oidindex old on online only opaque open operations operator optimal optimize option optionally or oracle oracle_date oradata ord ordaudio orddicom orddoc order ordimage ordinality ordvideo organization orlany orlvary out outer outfile outline output over overflow overriding package pad parallel parallel_enable parameters parent parse partial partition partitions pascal passing password password_grace_time password_lock_time password_reuse_max password_reuse_time password_verify_function patch path patindex pctincrease pctthreshold pctused pctversion percent percent_rank percentile_cont percentile_disc performance period period_add period_diff permanent physical pi pipe pipelined pivot pluggable plugin policy position post_transaction pow power pragma prebuilt precedes preceding precision prediction prediction_cost prediction_details prediction_probability prediction_set prepare present preserve prior priority private private_sga privileges procedural procedure procedure_analyze processlist profiles project prompt protection public publishingservername purge quarter query quick quiesce quota quotename radians raise rand range rank raw read reads readsize rebuild record records recover recovery recursive recycle redo reduced ref reference referenced references referencing refresh regexp_like register regr_avgx regr_avgy regr_count regr_intercept regr_r2 regr_slope regr_sxx regr_sxy reject rekey relational relative relaylog release release_lock relies_on relocate rely rem remainder rename repair repeat replace replicate replication required reset resetlogs resize resource respect restore restricted result result_cache resumable resume retention return returning returns reuse reverse revoke right rlike role roles rollback rolling rollup round row row_count rowdependencies rowid rownum rows rtrim rules safe salt sample save savepoint sb1 sb2 sb4 scan schema schemacheck scn scope scroll sdo_georaster sdo_topo_geometry search sec_to_time second section securefile security seed segment select self sequence sequential serializable server servererror session session_user sessions_per_user set sets settings sha sha1 sha2 share shared shared_pool short show shrink shutdown si_averagecolor si_colorhistogram si_featurelist si_positionalcolor si_stillimage si_texture siblings sid sign sin size size_t sizes skip slave sleep smalldatetimefromparts smallfile snapshot some soname sort soundex source space sparse spfile split sql sql_big_result sql_buffer_result sql_cache sql_calc_found_rows sql_small_result sql_variant_property sqlcode sqldata sqlerror sqlname sqlstate sqrt square standalone standby start starting startup statement static statistics stats_binomial_test stats_crosstab stats_ks_test stats_mode stats_mw_test stats_one_way_anova stats_t_test_ stats_t_test_indep stats_t_test_one stats_t_test_paired stats_wsr_test status std stddev stddev_pop stddev_samp stdev stop storage store stored str str_to_date straight_join strcmp strict string struct stuff style subdate subpartition subpartitions substitutable substr substring subtime subtring_index subtype success sum suspend switch switchoffset switchover sync synchronous synonym sys sys_xmlagg sysasm sysaux sysdate sysdatetimeoffset sysdba sysoper system system_user sysutcdatetime table tables tablespace tan tdo template temporary terminated tertiary_weights test than then thread through tier ties time time_format time_zone timediff timefromparts timeout timestamp timestampadd timestampdiff timezone_abbr timezone_minute timezone_region to to_base64 to_date to_days to_seconds todatetimeoffset trace tracking transaction transactional translate translation treat trigger trigger_nestlevel triggers trim truncate try_cast try_convert try_parse type ub1 ub2 ub4 ucase unarchived unbounded uncompress under undo unhex unicode uniform uninstall union unique unix_timestamp unknown unlimited unlock unpivot unrecoverable unsafe unsigned until untrusted unusable unused update updated upgrade upped upper upsert url urowid usable usage use use_stored_outlines user user_data user_resources users using utc_date utc_timestamp uuid uuid_short validate validate_password_strength validation valist value values var var_samp varcharc vari varia variab variabl variable variables variance varp varraw varrawc varray verify version versions view virtual visible void wait wallet warning warnings week weekday weekofyear wellformed when whene whenev wheneve whenever where while whitespace with within without work wrapped xdb xml xmlagg xmlattributes xmlcast xmlcolattval xmlelement xmlexists xmlforest xmlindex xmlnamespaces xmlpi xmlquery xmlroot xmlschema xmlserialize xmltable xmltype xor year year_to_month years yearweek",literal:"true false null",built_in:"array bigint binary bit blob boolean char character date dec decimal float int int8 integer interval number numeric real record serial serial8 smallint text varchar varying void"},c:[{cN:"string",b:"'",e:"'",c:[e.BE,{b:"''"}]},{cN:"string",b:'"',e:'"',c:[e.BE,{b:'""'}]},{cN:"string",b:"`",e:"`",c:[e.BE]},e.CNM,e.CBCM,t]},e.CBCM,t]}});hljs.registerLanguage("java",function(e){var t=e.UIR+"(<"+e.UIR+"(\\s*,\\s*"+e.UIR+")*>)?",a="false synchronized int abstract float private char boolean static null if const for true while long strictfp finally protected import native final void enum else break transient catch instanceof byte super volatile case assert short package default double public try this switch continue throws protected public private module requires exports",r="\\b(0[bB]([01]+[01_]+[01]+|[01]+)|0[xX]([a-fA-F0-9]+[a-fA-F0-9_]+[a-fA-F0-9]+|[a-fA-F0-9]+)|(([\\d]+[\\d_]+[\\d]+|[\\d]+)(\\.([\\d]+[\\d_]+[\\d]+|[\\d]+))?|\\.([\\d]+[\\d_]+[\\d]+|[\\d]+))([eE][-+]?\\d+)?)[lLfF]?",s={cN:"number",b:r,r:0};return{aliases:["jsp"],k:a,i:/<\/|#/,c:[e.C("/\\*\\*","\\*/",{r:0,c:[{b:/\w+@/,r:0},{cN:"doctag",b:"@[A-Za-z]+"}]}),e.CLCM,e.CBCM,e.ASM,e.QSM,{cN:"class",bK:"class interface",e:/[{;=]/,eE:!0,k:"class interface",i:/[:"\[\]]/,c:[{bK:"extends implements"},e.UTM]},{bK:"new throw return else",r:0},{cN:"function",b:"("+t+"\\s+)+"+e.UIR+"\\s*\$",rB:!0,e:/[{;=]/,eE:!0,k:a,c:[{b:e.UIR+"\\s*\\(",rB:!0,r:0,c:[e.UTM]},{cN:"params",b:/\(/,e:/$/,k:a,r:0,c:[e.ASM,e.QSM,e.CNM,e.CBCM]},e.CLCM,e.CBCM]},s,{cN:"meta",b:"@[A-Za-z]+"}]}});

Ignore Space Show notes View

src/main/webapp/login.jsp

Show notes View src/main/webapp/phishing.jpg 100644 → 0

Show notes View

src/main/webapp/safe_search.jsp 100644 → 0

Show notes View

src/main/webapp/safe_searchresults.jsp 100644 → 0

Show notes View

src/main/webapp/search.jsp 100644 → 0

Show notes View

src/main/webapp/searchresults.jsp 100644 → 0

Show notes View src/main/webapp/trump.jpg 100644 → 0

Show notes View src/main/webapp/trust-us.jpg 100644 → 0

Show line notes below