Sync fork with WebGoat/WebGoat main by fgibelin · Pull Request #44 · fgibelin/WebGoat

fgibelin · 2026-10-12T07:12:39Z

Summary

Sync the fork with all six new commits from WebGoat/WebGoat:main, through 7e198f39189f33e1912f7cbb60e24e42635ca06a, preserving upstream commits unchanged.

416d2a1b docs(cryptography): explain timing attack solutions
4441470e feat(challenges): add chained security scenario
cbc3bb09 fix(sql-injection): mark registration assignment solved
2d57cc9d fix(progress): allow users to share lesson assignments
10cecda8 fix(challenges): record Challenge 8 completion
7e198f39 chore(release): prepare 2026.5

Merge condition

Merge only after all PR checks pass, then delete the sync branch.

Learners need concrete steps to interpret the timing measurements after each attack. Matching heading sizes also make the lesson pages easier to follow.

Add a partner feed recovery scenario that combines multiple application weaknesses, with unit, integration, and browser coverage. Update exercise language to focus on investigation and composition, and make lesson documentation changes visible during Spring Boot development. The updated challenge feedback and German category label caused existing integration checks to fail even though the exercises still work.

Successful registration currently leaves the advanced SQL injection lesson incomplete, preventing learners from reaching full progress. Closes: WebGoat#2575

A unique progress constraint prevented later users from completing CSRF assignments and returned HTTP 500 when they solved the same challenge. Closes: WebGoat#2573

Submitting the correct flag currently leaves Challenge 8 incomplete, so learners cannot reach full progress in the report card. Closes: WebGoat#2574

+      AtomicBoolean reachedInternalThroughRedirect = new AtomicBoolean();
+      InputSource source = new InputSource(new StringReader(xml));
+      source.setSystemId(importUri.toString());
+      Document document = newDocumentBuilder(state, importUri, reachedInternalThroughRedirect).parse(source);


Copilot

🟡 Changes recommended

Challenge 2 retains its completed attack-chain state across lesson restarts, allowing the previous result to bypass the reset exercise.

1 open finding

Reset completion state when Challenge2 restarts · New

What changed in this PR

Syncs the fork with six upstream WebGoat commits through the 2026.5 release.

Changes:

Adds the chained Partner Feed Recovery security exercise.
Adds timing-attack solutions and fixes progress tracking.
Prepares release 2026.5 with updated documentation and tests.

File	Description
`WEBGOAT_IN_THE_AGE_OF_AI.md`	Documents AI-era lesson design.
`src/test/java/org/owasp/webgoat/lessons/cryptography/timing/TimingAttacksTest.java`	Tests solution rendering.
`src/test/java/org/owasp/webgoat/lessons/challenges/challenge2/Challenge2Test.java`	Tests the chained challenge.
`src/test/java/org/owasp/webgoat/lessons/challenges/Assignment1Test.java`	Updates expected feedback.
`src/test/java/org/owasp/webgoat/container/users/UserProgressRepositoryTest.java`	Tests shared assignments.
`src/test/java/org/owasp/webgoat/container/AssignmentProgressMigrationTest.java`	Verifies progress migration.
`src/main/resources/lessons/cryptography/html/TimingAttacks.html`	Adds solution pages.
`src/main/resources/lessons/cryptography/documentation/timing-attacks-recovery.adoc`	Adjusts heading level.
`src/main/resources/lessons/cryptography/documentation/timing-attacks-recovery-solution.adoc`	Documents tag recovery.
`src/main/resources/lessons/cryptography/documentation/timing-attacks-noise.adoc`	Adjusts heading level.
`src/main/resources/lessons/cryptography/documentation/timing-attacks-noise-solution.adoc`	Documents noisy recovery.
`src/main/resources/lessons/cryptography/documentation/timing-attacks-mitigation.adoc`	Adjusts heading level.
`src/main/resources/lessons/cryptography/documentation/timing-attacks-jwt.adoc`	Adjusts heading level.
`src/main/resources/lessons/cryptography/documentation/timing-attacks-introduction.adoc`	Adjusts heading level.
`src/main/resources/lessons/cryptography/documentation/timing-attacks-discovery.adoc`	Adjusts heading level.
`src/main/resources/lessons/cryptography/documentation/timing-attacks-discovery-solution.adoc`	Documents timing discovery.
`src/main/resources/lessons/challenges/js/challenge2.js`	Implements feed preview UI.
`src/main/resources/lessons/challenges/i18n/WebGoatLabels.properties`	Updates challenge labels.
`src/main/resources/lessons/challenges/i18n/WebGoatLabels_nl.properties`	Updates Dutch titles.
`src/main/resources/lessons/challenges/i18n/WebGoatLabels_fr.properties`	Updates French titles.
`src/main/resources/lessons/challenges/i18n/WebGoatLabels_de.properties`	Updates German titles.
`src/main/resources/lessons/challenges/html/Challenge8.html`	Standardizes result submission.
`src/main/resources/lessons/challenges/html/Challenge7.html`	Standardizes result submission.
`src/main/resources/lessons/challenges/html/Challenge6.html`	Standardizes result submission.
`src/main/resources/lessons/challenges/html/Challenge5.html`	Standardizes result submission.
`src/main/resources/lessons/challenges/html/Challenge2.html`	Adds the partner-feed dashboard.
`src/main/resources/lessons/challenges/html/Challenge1.html`	Standardizes result submission.
`src/main/resources/lessons/challenges/documentation/Challenge_introduction.adoc`	Reframes security exercises.
`src/main/resources/lessons/challenges/documentation/Challenge_introduction_es.adoc`	Updates Spanish introduction.
`src/main/resources/lessons/challenges/css/challenge2.css`	Styles the new dashboard.
`src/main/resources/lessons/challenges/css/challenge-flag.css`	Shares flag-form styling.
`src/main/resources/i18n/messages.properties`	Renames the challenge category.
`src/main/resources/i18n/messages_nl.properties`	Updates Dutch category text.
`src/main/resources/i18n/messages_fr.properties`	Updates French category text.
`src/main/resources/i18n/messages_es.properties`	Updates Spanish category text.
`src/main/resources/i18n/messages_de.properties`	Updates German category text.
`src/main/resources/db/container/V3__allow_shared_assignments.sql`	Removes assignment uniqueness.
`src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionChallenge.java`	Records registration completion.
`src/main/java/org/owasp/webgoat/lessons/challenges/FlagController.java`	Records Challenge 8 completion.
`src/main/java/org/owasp/webgoat/lessons/challenges/challenge2/NorthstarEndpoints.java`	Adds feed and redirect endpoints.
`src/main/java/org/owasp/webgoat/lessons/challenges/challenge2/InternalDiagnostic.java`	Adds protected diagnostics.
`src/main/java/org/owasp/webgoat/lessons/challenges/challenge2/FeedImportEndpoint.java`	Adds XML feed import.
`src/main/java/org/owasp/webgoat/lessons/challenges/challenge2/Challenge2State.java`	Stores session challenge state.
`src/main/java/org/owasp/webgoat/lessons/challenges/challenge2/Challenge2.java`	Defines the new lesson.
`src/main/java/org/owasp/webgoat/lessons/challenges/challenge2/ChainedXmlService.java`	Implements bounded XXE handling.
`src/main/java/org/owasp/webgoat/lessons/challenges/challenge2/ChainedFetchService.java`	Implements the redirect chain.
`src/main/java/org/owasp/webgoat/lessons/challenges/challenge2/Assignment2.java`	Validates challenge completion.
`src/main/java/org/owasp/webgoat/container/users/AssignmentProgress.java`	Allows shared assignments.
`src/it/java/org/owasp/webgoat/playwright/webgoat/lessons/TimingAttacksLessonUITest.java`	Tests solution navigation.
`src/it/java/org/owasp/webgoat/playwright/webgoat/lessons/Challenge2UITest.java`	Tests the challenge UI.
`src/it/java/org/owasp/webgoat/integration/SqlInjectionAdvancedIntegrationTest.java`	Verifies registration progress.
`src/it/java/org/owasp/webgoat/integration/MultiUserProgressIntegrationTest.java`	Tests multi-user progress.
`src/it/java/org/owasp/webgoat/integration/ChallengeIntegrationTest.java`	Tests Challenge 8 completion.
`src/it/java/org/owasp/webgoat/integration/Challenge2IntegrationTest.java`	Tests the complete attack chain.
`RELEASE_NOTES.md`	Adds 2026.5 release notes.
`pom.xml`	Sets version 2026.5 and live resources.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+
+  private final String flag;
+  private final String internalToken;
+  private boolean reachedThroughXml;


fgibelin · 2026-10-12T07:20:38Z

Sync status: all six upstream commits through 7e198f3 are included unchanged. Copilot is assigned, and Copilot code review completed. Pre-commit, Windows/Linux/macOS builds, and all three CodeQL analysis jobs passed. However, the CodeQL security gate failed on a new critical XXE alert in src/main/java/org/owasp/webgoat/lessons/challenges/challenge2/ChainedXmlService.java:40. Copilot review also recommends resetting Challenge 2 completion state on restart. Per the requested all-checks-passed condition, this PR has not been merged or closed, and its branch is retained. No lesson vulnerability was changed or security alert dismissed.

nbaars added 6 commits October 11, 2026 13:36

docs(cryptography): explain timing attack solutions (WebGoat#2577)

416d2a1

Learners need concrete steps to interpret the timing measurements after each attack. Matching heading sizes also make the lesson pages easier to follow.

fix(sql-injection): mark registration assignment solved

cbc3bb0

Successful registration currently leaves the advanced SQL injection lesson incomplete, preventing learners from reaching full progress. Closes: WebGoat#2575

fix(progress): allow users to share lesson assignments

2d57cc9

A unique progress constraint prevented later users from completing CSRF assignments and returned HTTP 500 when they solved the same challenge. Closes: WebGoat#2573

fix(challenges): record Challenge 8 completion

10cecda

Submitting the correct flag currently leaves Challenge 8 incomplete, so learners cannot reach full progress in the report card. Closes: WebGoat#2574

chore(release): prepare 2026.5

7e198f3

fgibelin requested a balanced review from Copilot October 12, 2026 07:12

fgibelin assigned Copilot Oct 12, 2026

Copilot started reviewing on behalf of fgibelin October 12, 2026 07:13

View session

github-advanced-security Bot found potential problems Oct 12, 2026

View reviewed changes

Copilot AI reviewed Oct 12, 2026

View reviewed changes

Comment thread src/main/java/org/owasp/webgoat/lessons/challenges/challenge2/Challenge2State.java

private final String flag;

private final String internalToken;

private boolean reachedThroughXml;

fgibelin merged commit 63dbc20 into main Oct 12, 2026
9 of 10 checks passed

Navigation Menu

Repository navigation

Sync fork with WebGoat/WebGoat main - #44

Sync fork with WebGoat/WebGoat main#44
fgibelin merged 6 commits into
mainfrom
fgibelin-sync-fork

fgibelin commented Oct 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

fgibelin commented Oct 12, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

fgibelin commented Oct 12, 2026

Summary

Merge condition

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

fgibelin commented Oct 12, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants