Create ContactController.java

pom.xml

@@ -147,6 +147,7 @@
     <!-- do not update necessary for lesson -->
     <zxcvbn.version>1.5.2</zxcvbn.version>
     <versions.java-security-toolkit>1.0.6</versions.java-security-toolkit>
+    <versions.java-security-toolkit-xstream>1.0.2</versions.java-security-toolkit-xstream>
   </properties>
 
   <dependencyManagement>
@@ -254,6 +255,11 @@
         <artifactId>java-security-toolkit</artifactId>
         <version>${versions.java-security-toolkit}</version>
       </dependency>
+      <dependency>
+        <groupId>io.github.pixee</groupId>
+        <artifactId>java-security-toolkit-xstream</artifactId>
+        <version>${versions.java-security-toolkit-xstream}</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
 
@@ -403,6 +409,10 @@
       <groupId>io.github.pixee</groupId>
       <artifactId>java-security-toolkit</artifactId>
     </dependency>
+    <dependency>
+      <groupId>io.github.pixee</groupId>
+      <artifactId>java-security-toolkit-xstream</artifactId>
+    </dependency>
   </dependencies>
 
   <repositories>

src/main/java/org/owasp/webgoat/lessons/vulnerablecomponents/ContactController.java

@@ -0,0 +1,56 @@
+package org.owasp.webgoat.vulnerable_components;
+
+
+import com.thoughtworks.xstream.XStream;
+import io.github.pixee.security.xstream.HardeningConverter;
+import java.sql.PreparedStatement;
+import org.owasp.webgoat.LessonDataSource;
+import org.springframework.web.bind.annotation.*;
+
+import java.sql.*;
+
+/** Handle contact management */
+@RestController
+public final class ContactController {
+
+    private final LessonDataSource dataSource;
+
+    public ContactController(LessonDataSource dataSource) {
+        this.dataSource = dataSource;
+    }
+
+    @GetMapping("/get-contact-phone")
+    public @ResponseBody
+    String getContactPhone(@RequestParam String userId) throws SQLException {
+      // get the phone number from the database
+      Connection conn = dataSource.getConnection();
+      String sql = "select phone from contacts where userid = ?";
+      PreparedStatement statement = conn.prepareStatement(sql);
+      statement.setString(1, userId);
+      ResultSet rs = statement.execute();
+      if(!rs.next()) {
+         throw new IllegalArgumentException("invalid contact");
+      }
+      return rs.getString("phone");
+    }
+
+    @GetMapping("/update-contact")
+    public @ResponseBody
+    void updateContact(@RequestBody String xml) throws SQLException {
+        // get the xml from our partner to update our contact record
+        Connection connection = dataSource.getConnection();
+        XStream xstream = new XStream();
+        xstream.registerConverter(new HardeningConverter());
+        Contact contact = (Contact) xstream.fromXML(xml);
+        String sql = "update contacts set phone = ? where userid = ?";
+        PreparedStatement stmt = connection.prepareStatement(sql);
+        stmt.setString(1, contact.name);
+        stmt.setString(2, contact.phone);
+        stmt.executeUpdate();
+    }
+
+    private static class Contact {
+        private String name;
+        private String phone;
+    }
+}