Skip to content

Latest commit

 

History

History
129 lines (92 loc) · 6.41 KB

RELEASE_NOTES.md

File metadata and controls

129 lines (92 loc) · 6.41 KB
Raw

WebGoat release notes

Unreleased

New functionality

  • New year's resolution: major refactoring of WebGoat to simplify the setup and improve building times.
  • Move away from multi-project setup:
    • This has a huge performance benefit when building the application. Build time locally is now Total time: 42.469 s (depends on your local machine of course)
    • No longer add Maven dependencies in several places
    • H2 no longer needs to run as separate process, which solves the issue of WebWolf sharing and needing to configure the correct database connection.
  • More explicit paths in html files to reference adoc files, less magic.
  • Integrate WebWolf in WebGoat, the setup was way too complicated and needed configuration which could lead to mistakes and a not working application. This also simplifies the Docker configuration as there is only 1 Docker image.
  • Add WebWolf button in WebGoat
  • Move all lessons into src/main/resources
  • WebGoat selects a port dynamically when starting. It will still start of port 8080 it will try another port to ease the user experience.
  • WebGoat logs URL after startup: Please browse to http://127.0.0.1:8080/WebGoat to get started...
  • Simplify Dockerfile as we no longer need a script to start everything
  • Maven build now start WebGoat jar with Maven plugin to make sure we run against the latest build.
  • Added Initializable interface for a lesson, an assignment can implement this interface to set it up for a specific user and to reset the assignment back to its original state when a reset lesson occurs. See BlindSendFileAssignment for an example.
  • Integration tests now use the same user. This saves a lot of time as before every test used a different user which triggered the Flyway migration to set up the database schema for the user. This migration took a lot of time.

Version 8.2.2

New functionality

  • Docker image now supports nginx when browsing to http://localhost a landing page is shown.

Bug fixes

Version 8.2.1

New functionality

  • New Docker image for arm64 architecture is now available (for Apple M1)

Version 8.2.0

New functionality

  • Add new zip slip lesson (part of path traversal)
  • SQL lessons are now separate for each user, database are now per user and no longer shared across users
  • Moved to Java 15 & Spring Boot 2.4 & moved to JUnit 5

Bug fixes

Contributors

Special thanks to the following contributors providing us with a pull request:

  • nicholas-quirk
  • VijoPlays
  • aolle
  • trollingHeifer
  • maximmasiutin
  • toshihue
  • avivmu
  • KellyMarchewa
  • NatasG
  • gabe-sky

Version 8.1.0

New functionality

  • Added new lessons for cryptography and path-traversal
  • Extra content added to the XXE lesson
  • Explanation of the assignments will be part of WebGoat, in this release we added detailed descriptions on how to solve the XXE lesson. In the upcoming releases new explanations will be added. If you want to contribute please create a pull request on Github.
  • Docker improvements + docker stack for complete container with nginx
  • Included JWT token decoding and generation, since jwt.io does not support None anymore

Bug fixes

Contributors

Special thanks to the following contributors providing us with a pull request:

  • Satoshi SAKAO
  • Philippe Lafoucrière
  • Cotonne
  • Tiago Mussi
  • thegoodcrumpets
  • Atharva Vaidya
  • torleif
  • August Detlefsen
  • Choe Hyeong Jin

And everyone who provided feedback through Github.

Team WebGoat