Merge branch 'main' into pixeebot/drip-2024-01-02-pixee-java/sandbox-…

…url-creation

pom.xml

@@ -146,7 +146,7 @@
     <xstream.version>1.4.5</xstream.version>
     <!-- do not update necessary for lesson -->
     <zxcvbn.version>1.5.2</zxcvbn.version>
-    <versions.java-security-toolkit>1.1.1</versions.java-security-toolkit>
+    <versions.java-security-toolkit-xstream>1.0.2</versions.java-security-toolkit-xstream>
   </properties>
 
   <dependencyManagement>
@@ -251,8 +251,8 @@
       </dependency>
       <dependency>
         <groupId>io.github.pixee</groupId>
-        <artifactId>java-security-toolkit</artifactId>
-        <version>${versions.java-security-toolkit}</version>
+        <artifactId>java-security-toolkit-xstream</artifactId>
+        <version>${versions.java-security-toolkit-xstream}</version>
       </dependency>
     </dependencies>
   </dependencyManagement>
@@ -401,7 +401,7 @@
     </dependency>
     <dependency>
       <groupId>io.github.pixee</groupId>
-      <artifactId>java-security-toolkit</artifactId>
+      <artifactId>java-security-toolkit-xstream</artifactId>
     </dependency>
   </dependencies>
 

src/main/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLesson.java

@@ -23,6 +23,7 @@
 package org.owasp.webgoat.lessons.vulnerablecomponents;
 
 import com.thoughtworks.xstream.XStream;
+import io.github.pixee.security.xstream.HardeningConverter;
 import org.apache.commons.lang3.StringUtils;
 import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
 import org.owasp.webgoat.container.assignments.AssignmentHints;
@@ -39,6 +40,7 @@ public class VulnerableComponentsLesson extends AssignmentEndpoint {
   @PostMapping("/VulnerableComponents/attack1")
   public @ResponseBody AttackResult completed(@RequestParam String payload) {
     XStream xstream = new XStream();
+    xstream.registerConverter(new HardeningConverter());
     xstream.setClassLoader(Contact.class.getClassLoader());
     xstream.alias("contact", ContactImpl.class);
     xstream.ignoreUnknownElements();