NoSqlInjection1.java

package servlets.module.challenge;

import java.io.IOException;
import java.io.PrintWriter;

import com.mongodb.BasicDBObject;
import com.mongodb.DB;
import com.mongodb.DBObject;
import com.mongodb.DBCollection;
import com.mongodb.DBCursor;
import com.mongodb.MongoClient;
import com.mongodb.MongoCredential;
import com.mongodb.MongoException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.apache.log4j.Logger;
import org.owasp.esapi.ESAPI;
import org.owasp.esapi.Encoder;

import utils.ShepherdLogManager;
import utils.Validate;

/**
 * NoSQL Injection Challenge One - Does not use user specific key
 * <br/><br/>
 * This file is part of the Security Shepherd Project.
 * 
 * The Security Shepherd project is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.<br/>
 * 
 * The Security Shepherd project is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.<br/>
 * 
 * You should have received a copy of the GNU General Public License
 * along with the Security Shepherd project.  If not, see <http://www.gnu.org/licenses/>. 
 * @author Paul McCann
 *
 */
public class NoSqlInjection1 extends HttpServlet
{
	//Sql Challenge 3
	private static final long serialVersionUID = 1L;
	private static org.apache.log4j.Logger log = Logger.getLogger(NoSqlInjection1.class);
	private static String levelName = "NoSQL Injection Challenge One";
	public static String levelHash = "d63c2fb5da9b81ca26237f1308afe54491d1bacf9fffa0b21a072b03c5bafe66";
	// private static String levelResult = ""; // Stored in Vulnerable DB. Not User Specific
	/**
	 * Users have to use NoSQL injection to get a specific user (Marlo) gamer ID. The query they are injecting into by default only outputs usernames.
	 * The input they enter is also been filtered.
	 * @param theUserName User name used in database look up.
	 */
	public void doPost (HttpServletRequest request, HttpServletResponse response) 
	throws ServletException, IOException
	{
		//Setting IpAddress To Log and taking header for original IP if forwarded from proxy
		ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"));
		//Attempting to recover user name of session that made request
		HttpSession ses = request.getSession(true);
		if(Validate.validateSession(ses))
		{
			ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), ses.getAttribute("userName").toString());
			log.debug(levelName + " servlet accessed by: " + ses.getAttribute("userName").toString());
		
			PrintWriter out = response.getWriter();  
			out.print(getServletInfo());
			String htmlOutput = new String();
			Encoder encoder = ESAPI.encoder();
			
			//MongoDb
			// To directly connect to a single MongoDB server (note that this will not auto-discover the primary even
			// if it's a member of a replica set:
			MongoClient mongoClient;
			@SuppressWarnings("unused")
			MongoCredential credential;
			DB mongoDb;
			//BasicDBObject whereQuery = new BasicDBObject();
			DBCollection coll;
			DBCursor cursor = null;
			
			String user;        // the user name
			String database;    // the name of the database in which the user is defined
			char[] password;    // the password as a character array
			
			try{
			
				log.debug("Getting Connection to Mongo Database");
				// To directly connect to a single MongoDB server (note that this will not auto-discover the primary even
				// if it's a member of a replica set:
				mongoClient = new MongoClient();
				
				user = "gamer1";
				database = "shepherdGames";
				password = new char[]{ '$', 'e', 'c', 'S', 'h', '3', 'p', 'd', 'b' };
				
				credential = MongoCredential.createCredential(user, database, password);
				mongoDb = mongoClient.getDB("shepherdGames");
				coll = mongoDb.getCollection("gamer");
				
				String gamerId = request.getParameter("theGamerName");
				log.debug("User Submitted - " + gamerId);
				String ApplicationRoot = getServletContext().getRealPath("");
				log.debug("Servlet root = " + ApplicationRoot );
				
				//whereQuery.put("_id", gamerId);
				DBObject whereQuery = new BasicDBObject("$where", "this._id == '" + gamerId + "'");
				cursor = coll.find(whereQuery);
				
				Object id;
				Object name;
				Object address;
				
				try
				{

									
					int i = 0;
					htmlOutput = "<h2 class='title'>Gamer Info</h2>";
					htmlOutput += "<table><tr><th>GamerId</th><th>Name</th><th>Address</th>";
					
					log.debug("Opening Result Set from query");

					while(cursor.hasNext()) {
						DBObject result = cursor.next();
						id = result.get("_id");
						name = result.get("name");
						address = result.get("address");
						
						log.debug("Mongodb Query Results " + result.toString());
						htmlOutput += "<tr><td>"
							+ encoder.encodeForHTML(id.toString()) + "</td><td>"
							+ encoder.encodeForHTML(name.toString()) + "</td><td>"
							+ encoder.encodeForHTML(address.toString()) + "</td></tr>";
						i++;
					}
					htmlOutput += "</table>";
					if(i == 0)
					{
						htmlOutput = "<p>There were no results found in your search</p>";
					}

				}
				catch (MongoException e)
				{
					log.debug("MongoDb Error caught - " + e.toString());
					htmlOutput += "<p>An error was detected!</p>" +
						"<p>" + encoder.encodeForHTML(e.toString()) + "</p>";
				}
				catch(Exception e)
				{
					out.write("An Error Occurred! You must be getting funky!");
					log.fatal(levelName + " - " + e.toString());
				}
				finally {
				    cursor.close();
				}
			}
			catch (MongoException e)
			{
				log.debug("MongoDb Error caught - " + e.toString());
				htmlOutput += "<p>An error was detected!</p>" +
					"<p>" + encoder.encodeForHTML(e.toString()) + "</p>";
			}

			log.debug("Outputting HTML");
			out.write(htmlOutput);
		}
		else
		{
			log.error(levelName + " servlet accessed with no session");
		}
	}
}