webgoat-Ajax-客户端过滤

版权声明：本文为博主原创文章，未经博主允许不得转载。 https://blog.csdn.net/aleenlee/article/details/86285321

Client Side Filtering

本实验分为两步：
1、通过页面查看隐藏数据，找到ceo的工资
	You are logged in as Moe Stooge, CSO of Goat Hills Financial. You have access to everyone in the company's information, except the CEO, Neville Bartholomew. Or at least you shouldn't have access to the CEO's information. For this exercise, examine the contents of the page to see what extra information you can find.
2、修复该问题
STAGE 2: Now, fix the problem. Modify the server to only return results that Moe Stooge is allowed to see.

#####解题思路

1、通过火狐web控制台，通过员工id进行查找，找到ceo的工资，submit
2、修复：原因是返回的信息过多，只允许返回经理能够看见的员工
找到代码：
	1、进入docker，如果没有vim命令需要下载：apt-get update,apt-get install vim
	2、find -name clientSideFiltering.jsp
	3、vim clientSideFiltering.jsp
	将：
	StringBuffer sb = new StringBuffer();

	sb.append("/Employees/Employee/UserID | ");
	sb.append("/Employees/Employee/FirstName | ");
	sb.append("/Employees/Employee/LastName | ");
	sb.append("/Employees/Employee/SSN | ");
	sb.append("/Employees/Employee/Salary ");
	String expression = sb.toString();
	StringBuffer sb = new StringBuffer();
调整为：
	sb.append("/Employees/Employee[Managers/Manager/text() = " + userId + "]/UserID | ");
	sb.append("/Employees/Employee[Managers/Manager/text() = " + userId + "]/FirstName | ");
	sb.append("/Employees/Employee[Managers/Manager/text() = " + userId + "]/LastName | ");
	sb.append("/Employees/Employee[Managers/Manager/text() = " + userId + "]/SSN | ");
	sb.append("/Employees/Employee[Managers/Manager/text() = " + userId + "]/Salary ");

	String expression = sb.toString();