What non-language specific vulnerabilities are present in this code? And what ex

Question

What non-language specific vulnerabilities are present in this code? And what exactly is happening at the line 43 block?

/////////////////////////////////////////////

package owasp.webgoat.lessons;

    import java.util.ArrayList;
    import java.util.List;
    import java.Util.*;
   /*
   -This is a java code that performs a certain utility.
   -To reduce code size some of the methods and souce codes to higher classes/dependencies have been deleted.
   -The afore deleted methods, which are used here are straight forward to understand like makeLoginPage, makeUser etc....
  
  
  
   */
    /***************************************************************************************************/
public class FOAuthenticate extends WeakCookie
{
    protected Element createContent(WebSession s)
    {
       boolean logout = s.getParser().getBooleanParameter(LOGOUT, false);
       if (logout)
       {
          s.setMessage("Goodbye!");
          s.eatCookies();
          return (makeLoginPage(s));
       }

       try
       {
          String username = "";
          String password = "";
          try
          {
             username = s.getParser().getRawParameter(USERNAME);
             password = s.getParser().getRawParameter(PASSWORD);

             // if credentials are bad, ask for login again
             if (username.equals("") || !password.equals(""))
             {
                s.setMessage("Invalid username and password entered.");
                return (makeLoginPage(s));
             }
           }
       catch (Exception e)
           {
              if (username.length() > 0 && e.getMessage().indexOf("not found") != -1)
              {
                 if ((username != null) && (username.length() > 0))
                 {
                    makeSuccess(s);
                    return (makeUser(s, username, "Welcome!!!!"));
                 }
              }
           }
             
       if (password.length() == 0)
           {
              if (username.length() != 0)
              {
                 s.setMessage("Invalid username and password entered.");
              }
              return (makeLoginPage(s));

           }

           if ((username != null) && (username.length() > 0) && (password.length() >0) && (password!=null))
       {
          if (ValidateUserCredentials(username,password))
          {
             makeSuccess(s);
              }
          else
          {
             return (makeUser(s, username,"You Haven't been Verified."));
          }
       }
        }
        catch (Exception e)
        {
           s.setMessage("Error generating " + this.getClass().getName());
        }

        return (makeLoginPage(s));
     }

   }
}

Explanation / Answer

import java.util.ArrayList;
    import java.util.List;
    import java.Util.*;
   /*
   -This is a java code that performs a certain utility.
   -To reduce code size some of the methods and souce codes to higher classes/dependencies have been deleted.
   -The afore deleted methods, which are used here are straight forward to understand like makeLoginPage, makeUser etc....
  
  
  
   */
    /***************************************************************************************************/
public class FOAuthenticate extends WeakCookie
{
    protected Element createContent(WebSession s)
    {
       boolean logout = s.getParser().getBooleanParameter(LOGOUT, false);
       if (logout)
       {
          s.setMessage("Goodbye!");
          s.eatCookies();
          return (makeLoginPage(s));
       }

       try
       {
          String username = "";
          String password = "";
          try
          {
             username = s.getParser().getRawParameter(USERNAME);
             password = s.getParser().getRawParameter(PASSWORD);

             // if credentials are bad, ask for login again
             if (username.equals("") || !password.equals(""))
             {
                s.setMessage("Invalid username and password entered.");
                return (makeLoginPage(s));
             }
           }
       catch (Exception e)
           {
              if (username.length() > 0 && e.getMessage().indexOf("not found") != -1)
              {
                 if ((username != null) && (username.length() > 0))
                 {
                    makeSuccess(s);
                    return (makeUser(s, username, "Welcome!!!!"));
                 }
              }
           }
             
       if (password.length() == 0)
           {
              if (username.length() != 0)
              {
                 s.setMessage("Invalid username and password entered.");
              }
              return (makeLoginPage(s));

           }

           if ((username != null) && (username.length() > 0) && (password.length() >0) && (password!=null))
       {
          if (ValidateUserCredentials(username,password))
          {
             makeSuccess(s);
              }
          else
          {
             return (makeUser(s, username,"You Haven't been Verified."));
          }
       }
        }
        catch (Exception e)
        {
           s.setMessage("Error generating " + this.getClass().getName());
        }

        return (makeLoginPage(s));
     }

   }
}

The comments you find are the common mal-practices that is peolple do

Related Questions

Navigate

• Browse (All)
• Browse W
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.