From 7e11c5c516c26b3fd9fa50cecdc688db79f67ec0 Mon Sep 17 00:00:00 2001 From: Dan Dunning <2349188+dunningdan@users.noreply.github.com> Date: Fri, 7 Nov 2025 12:03:15 -0500 Subject: [PATCH 1/2] =?UTF-8?q?=E2=9C=A8=20Add=20vulnerable=20searchUser?= =?UTF-8?q?=20endpoint=20to=20demonstrate=20SQL=20injection?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This endpoint is intentionally vulnerable for security scanning demos. It uses direct string concatenation in SQL queries, making it susceptible to SQL injection attacks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- .../advanced/SqlInjectionChallenge.java | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionChallenge.java b/src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionChallenge.java index 95f86ca0234..8f52d48266b 100644 --- a/src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionChallenge.java +++ b/src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionChallenge.java @@ -29,6 +29,7 @@ import org.owasp.webgoat.container.assignments.AssignmentHints; import org.owasp.webgoat.container.assignments.AttackResult; import org.springframework.util.StringUtils; +import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.PutMapping; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.ResponseBody; @@ -101,4 +102,48 @@ private AttackResult checkArguments(String username_reg, String email_reg, Strin } return null; } + + /** + * VULNERABLE ENDPOINT - Demonstrates SQL Injection vulnerability This endpoint is intentionally + * vulnerable to demonstrate security scanning + */ + @GetMapping("/SqlInjectionAdvanced/searchUser") + @ResponseBody + public AttackResult searchUser(@RequestParam("searchTerm") String searchTerm) { + try (Connection connection = dataSource.getConnection()) { + // VULNERABILITY: SQL Injection - Direct string concatenation + String vulnerableQuery = + "SELECT userid, email FROM sql_challenge_users WHERE userid LIKE '%" + + searchTerm + + "%' OR email LIKE '%" + + searchTerm + + "%'"; + + Statement statement = connection.createStatement(); + ResultSet resultSet = statement.executeQuery(vulnerableQuery); + + StringBuilder results = new StringBuilder(); + int count = 0; + while (resultSet.next()) { + results + .append("User: ") + .append(resultSet.getString("userid")) + .append(", Email: ") + .append(resultSet.getString("email")) + .append("\n"); + count++; + } + + if (count > 0) { + return success(this) + .feedback("Found " + count + " user(s):\n" + results.toString()) + .build(); + } else { + return success(this).feedback("No users found matching: " + searchTerm).build(); + } + } catch (SQLException e) { + log.error("SQL error in searchUser", e); + return failed(this).output("Database error: " + e.getMessage()).build(); + } + } } From 428d4b9e9742022e6b6453e5b59b7fb412e129db Mon Sep 17 00:00:00 2001 From: Dan Dunning <2349188+dunningdan@users.noreply.github.com> Date: Fri, 7 Nov 2025 12:27:02 -0500 Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=94=A7=20Configure=20Polaris=20to=20r?= =?UTF-8?q?un=20SAST=20only=20(no=20SCA)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Changed polaris_assessment_types from "SCA,SAST" to "SAST" only for both full scan and PR scan steps. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- .github/workflows/polaris.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/polaris.yaml b/.github/workflows/polaris.yaml index 7397c2f1d5f..0157e1f9984 100644 --- a/.github/workflows/polaris.yaml +++ b/.github/workflows/polaris.yaml @@ -26,7 +26,7 @@ jobs: polaris_access_token: ${{ secrets.POLARIS_ACCESS_TOKEN }} polaris_application_name: ${{ github.event.repository.name }} polaris_project_name: ${{ github.repository_owner }} - polaris_assessment_types: "SCA,SAST" + polaris_assessment_types: "SAST" # polaris_waitForScan: false # Used to support the async mode # project_directory: ${{ vars.PROJECT_DIRECTORY }} @@ -78,7 +78,7 @@ jobs: polaris_access_token: ${{ secrets.POLARIS_ACCESS_TOKEN }} polaris_application_name: ${{ github.event.repository.name }} polaris_project_name: ${{ github.repository_owner }} - polaris_assessment_types: "SCA,SAST" + polaris_assessment_types: "SAST" # project_directory: ${{ vars.PROJECT_DIRECTORY }} ### Uncomment this to use Source Upload method. Default value is hybrid (build based)