Fix bug in servlet

mark.george / jetty

Browse code Fix bug in servlet master
1 parent 1af6cef commit fe2681695fef3bd7b6929de2b8972aa3ffe7268b Mark George authored on 6 Sep 2021

Patch

Showing 43 changed files

Ignore Space Show notes View db/users.h2.db
Not supported

Show notes View deploy/META-INF/MANIFEST.MF 100644 → 0
Manifest-Version: 1.0

Show notes View deploy/WEB-INF/classes/Start.class 100644 → 0
Not supported

Show notes View deploy/WEB-INF/classes/dao/DbConnection.class 100644 → 0
Not supported

Show notes View deploy/WEB-INF/classes/servlets/BetterLoginServlet.class 100644 → 0
Not supported

Show notes View deploy/WEB-INF/classes/servlets/DodgyLoginServlet.class 100644 → 0
Not supported

Show notes View deploy/WEB-INF/jspf/menu.jspf 100644 → 0
<div id="menu"> <a href=".">Home</a> <a href="login.jsp">Log In</a> </div>

Show notes View deploy/WEB-INF/lib/apache-el-9.0.29.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/apache-jsp-10.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/apache-jsp-9.0.29.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/asm-9.1.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/asm-analysis-9.1.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/asm-commons-9.1.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/asm-tree-9.1.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/ecj-3.19.0.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/h2-1.4.200.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jakarta.annotation-api-1.3.5.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jakarta.transaction-api-1.3.2.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-annotations-10.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-http-10.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-io-10.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-jndi-10.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-plus-10.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-schemas-4.0.3.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-security-10.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-server-10.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-servlet-10.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-servlet-api-4.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-slf4j-impl-10.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-util-10.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-webapp-10.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/jetty-xml-10.0.6.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/logback-classic-1.2.5.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/logback-core-1.2.5.jar 100644 → 0
Not supported

Show notes View deploy/WEB-INF/lib/slf4j-api-2.0.0-alpha1.jar 100644 → 0
Not supported

Show notes View deploy/css/forms.css 100644 → 0
/* Two column form layout, with right aligned labels. This has been tested (using HTML4.01 strict) with: - Firefox 3 - 6, - IE 8 (earlier versions do NOT work) - Chrome 2 - 13 (WebKit) - Opera 10 - 11.5 If font family and size is fixed then the forms should look the same in all of the above browsers. The HTML to use this layout should use the following structure: <form> <fieldset> <legend>legend</legend> <label>Label 1:<input type="text"></label> <label>Label 2:<input type="text"></label> <button type="submit">Submit</button> </fieldset> </form> The labels surround the input components to ensure they stay together. Oversized labels will break the layout so resize the fieldsets to suit. Author: Mark George <mgeorge@infoscience.otago.ac.nz> / fieldset { width: 20em; / effective width of field set / padding: 10px; / padding to space the components from the fieldset border / padding-top: 0px; / IE counts the top of the legend as the top of the fieldset meaning backgound color also covers the legend. padding-top makes this effect worse so set it to 0. / } fieldset label, fieldset input, fieldset textarea, fieldset select { vertical-align: middle; / ensure labels and input components are vertically centred / margin-top: 4px; / add some spacing between form 'rows' / margin-bottom: 4px; / add some spacing between form 'rows' / } fieldset label { text-align: right; / align the label text right / display: block; / make the label represent a single row in the layout / } fieldset input, fieldset textarea, fieldset select { width: 150px; / width of the form components / margin-left: 5px; / add some spacing between the label and the component / } fieldset [type="submit"], fieldset [type="reset"] { margin: auto; / restore margin for submit/reset buttons / margin-top: 5px; / add some top margin to space submit button from rest of form / width: 100%; / make submit buttons full width */ }

Show notes View

deploy/css/forms.css 100644 → 0

Two column form layout, with right aligned labels.

This has been tested (using HTML4.01 strict) with:
    - Firefox 3 - 6,
    - IE 8 (earlier versions do NOT work)
    - Chrome 2 - 13 (WebKit)
    - Opera 10 - 11.5

If font family and size is fixed then the forms should look the same in all of
the above browsers.

The HTML to use this layout should use the following structure:

<form>
   <fieldset>
      <legend>legend</legend>
      <label>Label 1:<input type="text"></label>
      <label>Label 2:<input type="text"></label>
      <button type="submit">Submit</button>
   </fieldset>
</form>

The labels surround the input components to ensure they stay together.

Oversized labels will break the layout so resize the fieldsets to suit.

Author:  Mark George <mgeorge@infoscience.otago.ac.nz>

fieldset {
   width: 20em;      /* effective width of field set */
   padding: 10px;    /* padding to space the components from the fieldset border */
   padding-top: 0px; /* IE counts the top of the legend as the top of the fieldset meaning backgound color also covers the legend.  padding-top makes this effect worse so set it to 0. */
}

fieldset label, fieldset input, fieldset textarea, fieldset select {
   vertical-align: middle; /* ensure labels and input components are vertically centred */
   margin-top: 4px;        /* add some spacing between form 'rows' */
   margin-bottom: 4px;     /*  add some spacing between form 'rows' */
}

fieldset label {
   text-align: right;    /* align the label text right */
   display: block;       /* make the label represent a single row in the layout */
}

fieldset input, fieldset textarea, fieldset select {
   width: 150px;       /* width of the form components */
   margin-left: 5px;   /* add some spacing between the label and the component */
}

fieldset *[type="submit"], fieldset *[type="reset"] {
   margin: auto;     /* restore margin for submit/reset buttons */
   margin-top: 5px;  /* add some top margin to space submit button from rest of form */
   width: 100%;      /* make submit buttons full width */
}

Show notes View deploy/css/style.css 100644 → 0
@import url("forms.css"); /* import forms layout / body { background: rgb(60,60,60); font-family: Arial; font-size: 12pt; } h1 { background: black; color: white; padding: 5px; margin-left:-20px; margin-right:-20px; text-align: center; } #content { border:thick; border-style:solid; border-color:black; border-radius: 25px 25px 25px 25px; / CSS3 / background:rgb(210,210,210); margin-top:10pt; margin-left:auto; margin-right:auto; margin-top:50px; padding: 20px; width:90%; max-width:800px; } table { margin-left:auto; margin-right:auto; position:relative; border-style:none; border-collapse: collapse; width: 90%; } td, th { border:thin; border-width: 1px 0px 1px 0px; border-style: dotted; padding-left: 5px; padding-right: 5px; } th { text-align: left; } div#menu { text-align:center; } div#welcome { text-align: left; } div#images { margin:auto; text-align:center; } div#menu a { border: medium; border-style: solid; border-radius: 10px 10px 10px 10px; background: rgb(200,200,200); text-decoration: none; font-weight: bolder; color: black; padding: 5px; margin: 3px; } input#quantityToAdd { width:3em; margin-right: 10px; } / fieldset fonts/colors/margins / fieldset { border-color:silver; background:rgb(200,200,200); margin:auto; } fieldset legend { color:black; font-weight:bold; } / make input components change color when focused / /input[type="text"]:hover, textarea:hover, select:hover, input[type="password"]:hover, input[type="text"]:focus, textarea:focus, select:focus, input[type="password"]:focus { background-color:#ffff99; border-color:#999999; }/ / numeric table cells / table .currency, table .quantity { text-align:right; } / fieldset widths / fieldset#login { width:245px; } fieldset#createaccount { width:250px; } fieldset#quantitytobuy { width:245px; } img { /display: block;*/ margin: auto; }

Show notes View

deploy/css/style.css 100644 → 0

@import url("forms.css");  /* import forms layout */

body {
   background: rgb(60,60,60);
   font-family: Arial;
   font-size: 12pt;
}

h1 {
   background: black;
   color: white;
   padding: 5px;
   margin-left:-20px;
   margin-right:-20px;
   text-align: center;
}

#content {
   border:thick;
   border-style:solid;
   border-color:black;
   border-radius: 25px 25px 25px 25px;         /* CSS3 */
   background:rgb(210,210,210);
   margin-top:10pt;
   margin-left:auto;
   margin-right:auto;
   margin-top:50px;
   padding: 20px;
   width:90%;
   max-width:800px;
}

table {
   margin-left:auto;
   margin-right:auto;
   position:relative;
   border-style:none;
   border-collapse: collapse;
   width: 90%;
}

td, th {
   border:thin;
   border-width: 1px 0px 1px 0px;
   border-style: dotted;
   padding-left: 5px;
   padding-right: 5px;
}

th {
   text-align: left;
}

div#menu {
   text-align:center;
}

div#welcome {
   text-align: left;
}

div#images {
   margin:auto;
   text-align:center;
}

div#menu a {
   border: medium;
   border-style: solid;
   border-radius: 10px 10px 10px 10px;
   background: rgb(200,200,200);
   text-decoration: none;
   font-weight: bolder;
   color: black;
   padding: 5px;
   margin: 3px;
}

input#quantityToAdd {
   width:3em;
   margin-right: 10px;
}

/* fieldset fonts/colors/margins */

fieldset {
   border-color:silver;
   background:rgb(200,200,200);
   margin:auto;
}

fieldset legend {
   color:black;
   font-weight:bold;
}

/* make input components change color when focused */

/*input[type="text"]:hover, textarea:hover, select:hover, input[type="password"]:hover,
input[type="text"]:focus, textarea:focus, select:focus, input[type="password"]:focus {
   background-color:#ffff99;
   border-color:#999999;
}*/

/* numeric table cells */

table .currency, table .quantity {
  text-align:right;
}

/* fieldset widths */

fieldset#login {
   width:245px;
}

fieldset#createaccount {
   width:250px;
}

fieldset#quantitytobuy {
   width:245px;
}

img {
   /*display: block;*/
   margin: auto;
}

Show notes View deploy/fake-cat.png 100644 → 0

Show notes View deploy/fake-dog.png 100644 → 0

Show notes View deploy/index.jsp 100644 → 0
<%@page contentType="text/html" pageEncoding="UTF-8"%> <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site</title> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <h1>Welcome to our awesome web site!</h1> <div id="images"> <img width="250" src="fake-cat.png" alt="Image of cat"/> <img width="250" src="fake-dog.png" alt="Image of dog"/> </div> </div> </body> </html>

Show notes View

deploy/index.jsp 100644 → 0

Show notes View deploy/login.jsp 100644 → 0
<!DOCTYPE html> <!-- used to demonstrate data theft via SQL injection --> <html> <head> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site - Login</title> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <h1>Welcome to our awesome web site!</h1> <fieldset><legend>Login</legend> <% if ("fail".equals(request.getParameter("login"))) { %> <p>Log in attempt failed. Please try again.</p> <% } %> <form action="login" method="POST"> <label>Username: <input type="text" name="username"></label> <label>Password: <input type="password" name="password"></label> <input type="submit" value="Login"> </form> </fieldset> </div> </body> </html>

Show notes View

deploy/login.jsp 100644 → 0

Show notes View deploy/welcome.jsp 100644 → 0
<%@page contentType="text/html" pageEncoding="UTF-8"%> <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site</title> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <% String user = (String) session.getAttribute("user");%> <h1>Welcome back <%=user%></h1> <div id="images"> <img width="250" src="fake-cat.png" alt="Image of cat"/> <img width="250" src="fake-dog.png" alt="Image of dog"/> </div> </div> </body> </html>

Show notes View

deploy/welcome.jsp 100644 → 0

Ignore Space Show notes View src/main/java/servlets/BetterLoginServlet.java
package servlets; import dao.DbConnection; import java.io.IOException; import java.sql.Connection; import java.sql.PreparedStatement; import java.sql.ResultSet; import java.sql.SQLException; import java.util.logging.Level; import java.util.logging.Logger; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; //@WebServlet(urlPatterns = {"/login"}) public class BetterLoginServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String username = request.getParameter("username"); String password = request.getParameter("password"); String sql = "select name from users where username = ? and password = ?"; try ( Connection con = DbConnection.getConnection(getServletContext()); PreparedStatement stmt = con.prepareStatement(sql); ) { stmt.setString(1, username); stmt.setString(2, password); ResultSet rs = stmt.executeQuery(); if (rs.next()) { String result = rs.getString("name"); request.getSession().setAttribute("user", result); response.sendRedirect("welcome.jsp"); } else { response.sendRedirect("login.jsp?login=fail"); } } catch (SQLException ex) { Logger.getLogger(BetterLoginServlet.class.getName()).log(Level.SEVERE, null, ex); } } } package servlets; import dao.DbConnection; import java.io.IOException; import java.sql.Connection; import java.sql.PreparedStatement; import java.sql.ResultSet; import java.sql.SQLException; import java.util.logging.Level; import java.util.logging.Logger; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; //@WebServlet(urlPatterns = {"/login"}) public class BetterLoginServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String username = request.getParameter("username"); String password = request.getParameter("password"); String sql = "select name from users where username = ? and password = ?;"; try ( Connection con = DbConnection.getConnection(getServletContext()); PreparedStatement stmt = con.prepareStatement(sql); ) { stmt.setString(1, username); stmt.setString(2, password); ResultSet rs = stmt.executeQuery(sql); if (rs.next()) { String result = rs.getString("name"); request.getSession().setAttribute("user", result); response.sendRedirect("welcome.jsp"); } else { response.sendRedirect("login.jsp?login=fail"); } } catch (SQLException ex) { Logger.getLogger(BetterLoginServlet.class.getName()).log(Level.SEVERE, null, ex); } } }

Ignore Space Show notes View

src/main/java/servlets/BetterLoginServlet.java

package servlets;

import dao.DbConnection;
import java.io.IOException;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

//@WebServlet(urlPatterns = {"/login"})
public class BetterLoginServlet extends HttpServlet {

@Override
	protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

String username = request.getParameter("username");
		String password = request.getParameter("password");

String sql = "select name from users where username = ? and password = ?";

try (
			Connection con = DbConnection.getConnection(getServletContext());
			PreparedStatement stmt = con.prepareStatement(sql);
			) {

stmt.setString(1, username);
			stmt.setString(2, password);

ResultSet rs = stmt.executeQuery();

if (rs.next()) {
				String result = rs.getString("name");
				request.getSession().setAttribute("user", result);
				response.sendRedirect("welcome.jsp");
			} else {
				response.sendRedirect("login.jsp?login=fail");
			}

} catch (SQLException ex) {
			Logger.getLogger(BetterLoginServlet.class.getName()).log(Level.SEVERE, null, ex);
		}
	}

}

package servlets;

//@WebServlet(urlPatterns = {"/login"})
public class BetterLoginServlet extends HttpServlet {

@Override
	protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

String username = request.getParameter("username");
		String password = request.getParameter("password");

String sql = "select name from users where username = ? and password = ?;";

try (
			Connection con = DbConnection.getConnection(getServletContext());
			PreparedStatement stmt = con.prepareStatement(sql);
			) {

stmt.setString(1, username);
			stmt.setString(2, password);

ResultSet rs = stmt.executeQuery(sql);

} catch (SQLException ex) {
			Logger.getLogger(BetterLoginServlet.class.getName()).log(Level.SEVERE, null, ex);
		}
	}

}

Show line notes below