From 2a7bde3bd7f805bc43cc1b8e70a27cda97ba4afc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Apr 2026 20:21:50 +0000 Subject: [PATCH 1/3] chore: bump the maven group across 1 directory with 2 updates Bumps the maven group with 2 updates in the / directory: [com.thoughtworks.xstream:xstream](https://github.com/x-stream/xstream) and [org.bitbucket.b_c:jose4j](https://bitbucket.org/b_c/jose4j). Updates `com.thoughtworks.xstream:xstream` from 1.4.5 to 1.4.21 - [Release notes](https://github.com/x-stream/xstream/releases) - [Commits](https://github.com/x-stream/xstream/commits) Updates `org.bitbucket.b_c:jose4j` from 0.9.3 to 0.9.6 - [Commits](https://bitbucket.org/b_c/jose4j/branches/compare/jose4j-0.9.6..jose4j-0.9.3) --- updated-dependencies: - dependency-name: com.thoughtworks.xstream:xstream dependency-version: 1.4.21 dependency-type: direct:production dependency-group: maven - dependency-name: org.bitbucket.b_c:jose4j dependency-version: 0.9.6 dependency-type: direct:production dependency-group: maven ... Signed-off-by: dependabot[bot] --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 210daa8d642..2f5ce9e18af 100644 --- a/pom.xml +++ b/pom.xml @@ -77,7 +77,7 @@ 25 2.3.1 0.9.1 - 0.9.3 + 0.9.6 3.7.1 1.19.1 3.14.0 @@ -105,7 +105,7 @@ 9090 3.13.1 1.2 - 1.4.5 + 1.4.21 1.9.0 From 559af06edb885daddc37e3c15dd8b5106551b454 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 22 Apr 2026 00:12:32 +0000 Subject: [PATCH 2/3] fix: allow vulnerable-components lesson to deserialize with xstream 1.4.21 Agent-Logs-Url: https://github.com/Cluster-Mesh/WebGoat/sessions/cbce017c-d330-4096-b2f0-e028d5794ec3 Co-authored-by: GGuerraReply <133228566+GGuerraReply@users.noreply.github.com> --- .../vulnerablecomponents/VulnerableComponentsLesson.java | 2 ++ .../vulnerablecomponents/VulnerableComponentsLessonTest.java | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/src/main/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLesson.java b/src/main/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLesson.java index e328be123da..35f514bb214 100644 --- a/src/main/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLesson.java +++ b/src/main/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLesson.java @@ -8,6 +8,7 @@ import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success; import com.thoughtworks.xstream.XStream; +import com.thoughtworks.xstream.security.AnyTypePermission; import org.apache.commons.lang3.StringUtils; import org.owasp.webgoat.container.assignments.AssignmentEndpoint; import org.owasp.webgoat.container.assignments.AssignmentHints; @@ -24,6 +25,7 @@ public class VulnerableComponentsLesson implements AssignmentEndpoint { @PostMapping("/VulnerableComponents/attack1") public @ResponseBody AttackResult completed(@RequestParam String payload) { XStream xstream = new XStream(); + xstream.addPermission(AnyTypePermission.ANY); xstream.setClassLoader(Contact.class.getClassLoader()); xstream.alias("contact", ContactImpl.class); xstream.ignoreUnknownElements(); diff --git a/src/test/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLessonTest.java b/src/test/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLessonTest.java index e9daf90d11f..0a34408060a 100644 --- a/src/test/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLessonTest.java +++ b/src/test/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLessonTest.java @@ -9,6 +9,7 @@ import com.thoughtworks.xstream.XStream; import com.thoughtworks.xstream.io.StreamException; +import com.thoughtworks.xstream.security.AnyTypePermission; import org.junit.jupiter.api.Disabled; import org.junit.jupiter.api.Test; @@ -31,6 +32,7 @@ public class VulnerableComponentsLessonTest { @Test public void testTransformation() throws Exception { XStream xstream = new XStream(); + xstream.addPermission(AnyTypePermission.ANY); xstream.setClassLoader(Contact.class.getClassLoader()); xstream.alias("contact", ContactImpl.class); xstream.ignoreUnknownElements(); @@ -41,6 +43,7 @@ public void testTransformation() throws Exception { @Disabled public void testIllegalTransformation() throws Exception { XStream xstream = new XStream(); + xstream.addPermission(AnyTypePermission.ANY); xstream.setClassLoader(Contact.class.getClassLoader()); xstream.alias("contact", ContactImpl.class); xstream.ignoreUnknownElements(); @@ -54,6 +57,7 @@ public void testIllegalTransformation() throws Exception { @Test public void testIllegalPayload() throws Exception { XStream xstream = new XStream(); + xstream.addPermission(AnyTypePermission.ANY); xstream.setClassLoader(Contact.class.getClassLoader()); xstream.alias("contact", ContactImpl.class); xstream.ignoreUnknownElements(); From e5410ecd88ca89dae20be2ce21726bf6797ea78c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 22 Apr 2026 00:14:44 +0000 Subject: [PATCH 3/3] docs: clarify intentional insecure xstream permission in lesson code Agent-Logs-Url: https://github.com/Cluster-Mesh/WebGoat/sessions/cbce017c-d330-4096-b2f0-e028d5794ec3 Co-authored-by: GGuerraReply <133228566+GGuerraReply@users.noreply.github.com> --- .../vulnerablecomponents/VulnerableComponentsLesson.java | 1 + .../vulnerablecomponents/VulnerableComponentsLessonTest.java | 3 +++ 2 files changed, 4 insertions(+) diff --git a/src/main/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLesson.java b/src/main/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLesson.java index 35f514bb214..fb98c68491e 100644 --- a/src/main/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLesson.java +++ b/src/main/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLesson.java @@ -25,6 +25,7 @@ public class VulnerableComponentsLesson implements AssignmentEndpoint { @PostMapping("/VulnerableComponents/attack1") public @ResponseBody AttackResult completed(@RequestParam String payload) { XStream xstream = new XStream(); + // Intentionally insecure for this lesson to demonstrate vulnerable deserialization behavior. xstream.addPermission(AnyTypePermission.ANY); xstream.setClassLoader(Contact.class.getClassLoader()); xstream.alias("contact", ContactImpl.class); diff --git a/src/test/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLessonTest.java b/src/test/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLessonTest.java index 0a34408060a..1acf6b9c6ff 100644 --- a/src/test/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLessonTest.java +++ b/src/test/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLessonTest.java @@ -32,6 +32,7 @@ public class VulnerableComponentsLessonTest { @Test public void testTransformation() throws Exception { XStream xstream = new XStream(); + // Intentionally insecure for this lesson to validate vulnerable deserialization behavior. xstream.addPermission(AnyTypePermission.ANY); xstream.setClassLoader(Contact.class.getClassLoader()); xstream.alias("contact", ContactImpl.class); @@ -43,6 +44,7 @@ public void testTransformation() throws Exception { @Disabled public void testIllegalTransformation() throws Exception { XStream xstream = new XStream(); + // Intentionally insecure for this lesson to validate vulnerable deserialization behavior. xstream.addPermission(AnyTypePermission.ANY); xstream.setClassLoader(Contact.class.getClassLoader()); xstream.alias("contact", ContactImpl.class); @@ -57,6 +59,7 @@ public void testIllegalTransformation() throws Exception { @Test public void testIllegalPayload() throws Exception { XStream xstream = new XStream(); + // Intentionally insecure for this lesson to validate vulnerable deserialization behavior. xstream.addPermission(AnyTypePermission.ANY); xstream.setClassLoader(Contact.class.getClassLoader()); xstream.alias("contact", ContactImpl.class);