SAST scan status

public ModelAndView attack(Authentication authentication, HttpServletRequest request, HttpServletResponse response) {
        return new ModelAndView("redirect:" + "start.mvc" + course.getFirstLesson().getLink());

.logout().deleteCookies("JSESSIONID").invalidateHttpSession(true);
        security.and().csrf().disable();

try (var connection = dataSource.getConnection()) {
            PreparedStatement statement = connection.prepareStatement("select password from challenge_users where userid = '" + username_login + "' and password = '" + password_login + "'");

try (var connection = dataSource.getConnection()) {
            PreparedStatement statement = connection.prepareStatement("select password from challenge_users where userid = '" + username_login + "' and password = '" + password_login + "'");

try {
                    System.out.println(MD5.getHashString(new File(element)) + " " + element);

// I will set here the thymeleaf fragment location based on the resource requested.
        ModelAndView model = new ModelAndView();

public ModelAndView start() {
        ModelAndView model = new ModelAndView();

		String md5Hash = (String) request.getSession().getAttribute("md5Hash");

		String sha256 = (String) request.getSession().getAttribute("sha256");

		    MessageDigest md = MessageDigest.getInstance("MD5");

		String privateKey = (String) request.getSession().getAttribute("privateKeyString");

before = System.currentTimeMillis();
            Object o = ois.readObject();

new ByteArrayInputStream(data));
        Object o = ois.readObject();

@RequestParam(value = "changeMe", required = false) String paramValue, HttpServletRequest request) {
        if (HttpMethod.POST.matches(request.getMethod())) {

public String getSecretToken() {
        return Jwts.builder()

ResponseEntity> checkDebuggingStatus() {
        log.debug("Checking label debugging, it is {}", labelDebugger.isEnabled());

ResponseEntity> setDebuggingStatus(@RequestParam("enabled") Boolean enabled) throws Exception {
        log.debug("Setting label debugging to {} ", labelDebugger.isEnabled());

Lesson lesson = webSession.getCurrentLesson();
        return new LessonInfoModel(lesson.getTitle(), false, false, false);

LessonMenuItem categoryItem = new LessonMenuItem();
            categoryItem.setName(category.getName());

public List lessonOverview() {
        UserTracker userTracker = userTrackerRepository.findByUser(webSession.getUserName());

String showPlan() {
        Lesson lesson = webSession.getCurrentLesson();

Lesson al = webSession.getCurrentLesson();
        log.debug("Restarting lesson: " + al);

String showSession(HttpServletRequest request, HttpSession session) {
        StringBuilder sb = new StringBuilder();

Statement statement = connection.createStatement();
                ResultSet resultSet = statement.executeQuery(checkUserQuery);

Statement statement = connection.createStatement();
                ResultSet resultSet = statement.executeQuery(checkUserQuery);

ResultSet.CONCUR_READ_ONLY)) {
                ResultSet results = statement.executeQuery(query);

ResultSet.CONCUR_READ_ONLY)) {
                ResultSet results = statement.executeQuery(query);

Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
                ResultSet results = statement.executeQuery(query);

Statement statement = connection.createStatement(TYPE_SCROLL_INSENSITIVE, CONCUR_READ_ONLY);
            ResultSet results = statement.executeQuery(query);

CONCUR_READ_ONLY);
                statement.executeUpdate(query);

try (Statement statement = connection.createStatement(TYPE_SCROLL_INSENSITIVE, CONCUR_READ_ONLY)) {
                statement.executeUpdate(query);

try (Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_UPDATABLE)) {
                ResultSet results = statement.executeQuery(query);

try (Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_UPDATABLE)) {
                ResultSet results = statement.executeQuery(query);

try (Connection connection = dataSource.getConnection()) {
            PreparedStatement query = connection.prepareStatement(queryString, ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);

Statement statement = connection.createStatement(TYPE_SCROLL_SENSITIVE, CONCUR_UPDATABLE);
            statement.executeUpdate(logQuery);

log(connection, query);
                ResultSet results = statement.executeQuery(query);

Statement statement = connection.createStatement(TYPE_SCROLL_SENSITIVE, CONCUR_UPDATABLE);
            statement.executeUpdate(logQuery);

SqlInjectionLesson8.log(connection, query);
                ResultSet results = statement.executeQuery(query);

URL u = new URL(url);
                URLConnection urlConnection = u.openConnection();

public String getSampleDTDFile() {
        return "\n"

public String getWebGoatHomeDirectory() {
        return webGoatHomeDirectory;

public String getFileLocation() {
        return fileLocation;

.anyRequest().permitAll();
        security.and().csrf().disable().formLogin()

return () -> {
            log.trace("Incoming request for: {}", request.getRequestURL());

try {
            Process p = Runtime.getRuntime().exec(taskAction);

if (request.getHeader("x-requested-with") != null) {
            response.sendError(401, authException.getMessage());

params.clear();
		params.put("answer_pwd1", answer_1);

private static boolean isAlreadyRunning(int port) {
        try (var ignored = new Socket("127.0.0.1", port)) {

params.put("username_reg", "tom' AND substring(password,1,1)='t");
        params.put("password_reg", "password");

params.put("email_reg", "someone@microsoft.com");
        params.put("confirm_password", "password");

params.put("username_login", "tom");
        params.put("password_login", "thisisasecretfortomonly");

public File pluginTargetDirectory(@Value("${webgoat.user.directory}") final String webgoatHome) {
        return new File(webgoatHome);

public String createPasswordReset(String username, String key) {
        Random random = new Random();

ClassPathResource classPathResource = new ClassPathResource("employees.xml");
        File targetDirectory = new File(webGoatHomeDirectory, "/ClientSideFiltering");

NodeList nodes = null;
        File d = new File(webGoatHomeDirectory, "ClientSideFiltering/employees.xml");

if (basicAuth == null) {
			String password = HashingAssignment.SECRETS[new Random().nextInt(HashingAssignment.SECRETS.length)];

			String secret = SECRETS[new Random().nextInt(SECRETS.length)];

if (sha256 == null) {
			String secret = SECRETS[new Random().nextInt(SECRETS.length)];

if (answer_pwd1!=null && answer_pwd2 !=null) {
        	if (answer_pwd1.equals(md5Secret)

if (answer_pwd1.equals(md5Secret)
        		&& answer_pwd2.equals(sha256Secret)) {

.build();
        	} else if (answer_pwd1.equals(md5Secret)

} else if (answer_pwd1.equals(md5Secret)
            		|| answer_pwd2.equals(sha256Secret)) {

if ("true".equals(req.getParameter("csrf"))) {
                Random random = new Random();

} else {
                Random random = new Random();

} else {
            Random random = new Random();

idorUserInfo.put("tom", new HashMap());
        idorUserInfo.get("tom").put("password", "cat");

idorUserInfo.put("bill", new HashMap());
        idorUserInfo.get("bill").put("password", "buffalo");

try (var connection = dataSource.getConnection()) {
                            ResultSet rs = connection.createStatement().executeQuery("SELECT key FROM jwt_keys WHERE id = '" + kid + "'");

try (var connection = dataSource.getConnection()) {
                            ResultSet rs = connection.createStatement().executeQuery("SELECT key FROM jwt_keys WHERE id = '" + kid + "'");

loginJson.put("user", "Jerry");
        loginJson.put("password", PASSWORD);

loginJson.put("user", "Jerry");
        loginJson.put("password", PASSWORD);

public static final String[] SECRETS = {"victory", "business", "available", "shipping", "washington"};
    public static final String JWT_SECRET = TextCodec.BASE64.encode(SECRETS[new Random().nextInt(SECRETS.length)]);

.compact();
            Cookie cookie = new Cookie("access_token", token);

} else {
            Cookie cookie = new Cookie("access_token", "");

.compact();
            Cookie cookie = new Cookie("access_token", token);

} else {
            Cookie cookie = new Cookie("access_token", "");

try {
            userService.addUser(newUser.getUsername(),newUser.getPassword(),newUser.getRole());

try {
            userService.addUser(newUser.getUsername(),newUser.getPassword(),newUser.getRole());

DisplayUser displayUser = new DisplayUser(user);
        if (userHash.equals(displayUser.getUserHash())) {

String passwordTom = usersToTomPassword.getOrDefault(getWebSession().getUserName(), PASSWORD_TOM_9);
            if (passwordTom.equals(PASSWORD_TOM_9)) {

public void solve() throws Exception {
        File targetFile = new File(webGoatHomeDirectory, "/XXE/secret.txt");

public void solveOnlyParamReferenceEntityInExternalDTD() throws Exception {
        File targetFile = new File(webGoatHomeDirectory, "/XXE/secret.txt");

public void createDirectory() {
        File file = new File(fileLocatation);

public Callable> sendEmail(@RequestBody Email email) {
        return () -> {