├── .travis.yml
├── src
    ├── main
    │   ├── java
    │   │   └── com
    │   │   │   └── contrastsecurity
    │   │   │       └── demo
    │   │   │           └── providersearch
    │   │   │               ├── Provider.java
    │   │   │               ├── SearchForm.java
    │   │   │               ├── ProviderSearchApplication.java
    │   │   │               ├── ProviderSearchDAO.java
    │   │   │               └── ProviderController.java
    │   └── resources
    │   │   ├── static
    │   │       └── img
    │   │       │   └── hands.jpg
    │   │   ├── application.properties
    │   │   ├── schema.sql
    │   │   ├── data.sql
    │   │   └── templates
    │   │       └── index.html
    └── test
    │   ├── resources
    │       └── application.properties
    │   └── java
    │       └── com
    │           └── contrastsecurity
    │               └── demo
    │                   └── providersearch
    │                       ├── ProviderSearchApplicationTests.java
    │                       └── ProviderControllerTest.java
├── .circleci
    └── config.yml
├── .gitignore
├── README.md
└── pom.xml


/.travis.yml:
--------------------------------------------------------------------------------
1 | language: java
2 | jdk: openjdk8
3 | 


--------------------------------------------------------------------------------
/src/main/java/com/contrastsecurity/demo/providersearch/Provider.java:
--------------------------------------------------------------------------------
1 | package com.contrastsecurity.demo.providersearch;
2 | 
3 | public class Provider {
4 | 
5 | }
6 | 


--------------------------------------------------------------------------------
/src/main/resources/static/img/hands.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/Contrast-Security-OSS/vulnerable-spring-boot-application/HEAD/src/main/resources/static/img/hands.jpg


--------------------------------------------------------------------------------
/.circleci/config.yml:
--------------------------------------------------------------------------------
 1 | version: 2.1
 2 | jobs:
 3 |   build:
 4 |     docker:
 5 |       - image: circleci/openjdk:8u171-jdk
 6 |     working_directory: ~/repo
 7 |     steps:
 8 |       - checkout
 9 |       - run: mvn clean install
10 | 


--------------------------------------------------------------------------------
/src/main/java/com/contrastsecurity/demo/providersearch/SearchForm.java:
--------------------------------------------------------------------------------
 1 | package com.contrastsecurity.demo.providersearch;
 2 | 
 3 | public class SearchForm {
 4 |     String zipCode;
 5 | 
 6 |     public String getZipCode() {
 7 |         return zipCode;
 8 |     }
 9 | 
10 |     public void setZipCode(String zipCode) {
11 |         this.zipCode = zipCode;
12 |     }
13 | }
14 | 


--------------------------------------------------------------------------------
/src/test/resources/application.properties:
--------------------------------------------------------------------------------
 1 | spring.thymeleaf.cache=false
 2 | spring.thymeleaf.enabled=true
 3 | spring.thymeleaf.prefix=classpath:/templates/
 4 | spring.thymeleaf.suffix=.html
 5 | spring.h2.console.enabled=true
 6 | spring.h2.console.path=/h2-console
 7 | spring.datasource.username=sa
 8 | spring.datasource.password=
 9 | 
10 | spring.application.name=Pinnacle Health Provider Search


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
 1 | /target/
 2 | !.mvn/wrapper/maven-wrapper.jar
 3 | 
 4 | ### STS ###
 5 | .apt_generated
 6 | .classpath
 7 | .factorypath
 8 | .project
 9 | .settings
10 | .springBeans
11 | .sts4-cache
12 | 
13 | ### IntelliJ IDEA ###
14 | .idea
15 | *.iws
16 | *.iml
17 | *.ipr
18 | 
19 | ### NetBeans ###
20 | /nbproject/private/
21 | /build/
22 | /nbbuild/
23 | /dist/
24 | /nbdist/
25 | /.nb-gradle/
26 | 
27 | .DS_Store
28 | .mvn/
29 | derby.log
30 | mvnenv.sh


--------------------------------------------------------------------------------
/src/main/resources/application.properties:
--------------------------------------------------------------------------------
 1 | server.port=${PORT:8080}
 2 | 
 3 | # Thymeleaf
 4 | 
 5 | spring.thymeleaf.cache=false
 6 | spring.thymeleaf.enabled=true
 7 | spring.thymeleaf.prefix=classpath:/templates/
 8 | spring.thymeleaf.suffix=.html
 9 | spring.h2.console.enabled=true
10 | spring.h2.console.path=/h2-console
11 | spring.datasource.username=sa
12 | spring.datasource.password=
13 | 
14 | spring.application.name=Pinnacle Health Provider Search
15 | 


--------------------------------------------------------------------------------
/src/main/java/com/contrastsecurity/demo/providersearch/ProviderSearchApplication.java:
--------------------------------------------------------------------------------
 1 | package com.contrastsecurity.demo.providersearch;
 2 | 
 3 | import org.springframework.boot.SpringApplication;
 4 | import org.springframework.boot.autoconfigure.SpringBootApplication;
 5 | 
 6 | @SpringBootApplication
 7 | public class ProviderSearchApplication {
 8 | 
 9 | 	public static void main(String[] args) {
10 | 		SpringApplication.run(ProviderSearchApplication.class, args);
11 | 	}
12 | }
13 | 


--------------------------------------------------------------------------------
/src/test/java/com/contrastsecurity/demo/providersearch/ProviderSearchApplicationTests.java:
--------------------------------------------------------------------------------
 1 | package com.contrastsecurity.demo.providersearch;
 2 | 
 3 | import org.junit.Test;
 4 | import org.junit.runner.RunWith;
 5 | import org.springframework.boot.test.context.SpringBootTest;
 6 | import org.springframework.test.context.junit4.SpringRunner;
 7 | 
 8 | @RunWith(SpringRunner.class)
 9 | @SpringBootTest
10 | public class ProviderSearchApplicationTests {
11 | 
12 | 	@Test
13 | 	public void contextLoads() {
14 | 	}
15 | 
16 | }
17 | 


--------------------------------------------------------------------------------
/src/main/resources/schema.sql:
--------------------------------------------------------------------------------
1 | DROP TABLE IF EXISTS PUBLIC.PROVIDERS
2 | 
3 | CREATE TABLE PUBLIC.PROVIDERS (id int(11) unsigned NOT NULL AUTO_INCREMENT,first_name varchar(100) DEFAULT NULL,last_name varchar(100) DEFAULT NULL,phone varchar(20),street_address varchar(255) DEFAULT NULL,city varchar(100) DEFAULT NULL,state varchar(100) DEFAULT NULL,zip_code varchar(5) DEFAULT NULL,specialty varchar(255) DEFAULT NULL, public_listing boolean DEFAULT NULL,suspended boolean DEFAULT NULL, taking_new_patients boolean DEFAULT NULL, PRIMARY KEY (id))


--------------------------------------------------------------------------------
/src/main/resources/data.sql:
--------------------------------------------------------------------------------
1 | INSERT INTO PUBLIC.PROVIDERS (id, first_name, last_name, phone, street_address, city, state, zip_code, specialty, public_listing, suspended, taking_new_patients)
2 | VALUES
3 | 	(1,'Stephen','Milner','410-333-3333','101 Main St','Baltimore','MD','21230','Internal Medicine',TRUE,FALSE,FALSE),
4 | 	(2,'Jane','Owens','410-333-3333','102 Main St','Baltimore','MD','21230','General Practice',TRUE,FALSE,TRUE),
5 | 	(3,'Alfred','Newman','410-333-3333','103 Main St','Baltimore','MD','21230','Ear, Nose, and Throat',FALSE,TRUE,FALSE);


--------------------------------------------------------------------------------
/src/main/java/com/contrastsecurity/demo/providersearch/ProviderSearchDAO.java:
--------------------------------------------------------------------------------
 1 | package com.contrastsecurity.demo.providersearch;
 2 | 
 3 | import javax.persistence.EntityManager;
 4 | import javax.persistence.EntityManagerFactory;
 5 | import javax.persistence.Query;
 6 | import java.util.List;
 7 | import org.springframework.beans.factory.annotation.Autowired;
 8 | import org.springframework.stereotype.Component;
 9 | 
10 | @Component
11 | public class ProviderSearchDAO {
12 |     @Autowired
13 |     private EntityManagerFactory entityManagerFactory;
14 | 
15 |     public List<Object[]> getProvidersInZipCode(String zipCode) {
16 |         EntityManager em = entityManagerFactory.createEntityManager();
17 |         String q = "select * from PROVIDERS where public_listing is true and zip_code = '" + zipCode + "'";
18 |         Query query = em.createNativeQuery(q);
19 |         List<Object[]> results = query.getResultList();
20 |         return results;
21 |     }
22 | }
23 | 
24 | 
25 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # Vulnerable Spring Boot Application
 2 | 
 3 | This application is an intentionally vulnerable Spring Boot application. The intent is to demonstrate the capabilities of Contrast Security's Maven plugin when used with continuous integration (such as TravisCI or CircleCI).
 4 | 
 5 | ## Build
 6 | 
 7 | ```
 8 | mvn install
 9 | ```
10 | 
11 | ## Run
12 | 
13 | ```
14 | java -jar target/provider-search-0.0.1-SNAPSHOT.jar
15 | ```
16 | 
17 | * Go to http://localhost:8080/
18 | * Search for zip 21230
19 | 
20 | ## Test
21 | 
22 | ```
23 | mvn clean test
24 | ```
25 | 
26 | ## Running With Contrast
27 | 
28 | You will need an account with Contrast https://www.contrastsecurity.com
29 | 
30 | * Review the `run-with-contrast` profile settings in `pom.xml`
31 | 
32 | * Set the following environment variables
33 | 
34 | ```
35 | CONTRAST_MAVEN_USERNAME
36 | CONTRAST_MAVEN_ORGUUID
37 | CONTRAST_MAVEN_TEAMSERVERURL
38 | CONTRAST_MAVEN_APIKEY
39 | CONTRAST_MAVEN_SERVICEKEY
40 | ```
41 | 
42 | * `mvn install -P run-with-contrast`
43 | 
44 | 
45 | ## Details
46 | 
47 | The application runs using an in-memory H2 database. Schema and sample data should load on boot.
48 | 


--------------------------------------------------------------------------------
/src/main/java/com/contrastsecurity/demo/providersearch/ProviderController.java:
--------------------------------------------------------------------------------
 1 | package com.contrastsecurity.demo.providersearch;
 2 | 
 3 | import java.util.List;
 4 | import java.util.Map;
 5 | import org.springframework.beans.factory.annotation.Autowired;
 6 | import org.springframework.beans.factory.annotation.Value;
 7 | import org.springframework.stereotype.Controller;
 8 | import org.springframework.ui.Model;
 9 | import org.springframework.web.bind.annotation.GetMapping;
10 | import org.springframework.web.bind.annotation.PostMapping;
11 | import org.springframework.web.bind.annotation.RequestMapping;
12 | import org.springframework.web.bind.annotation.RequestParam;
13 | 
14 | @Controller
15 | @RequestMapping("/")
16 | public class ProviderController {
17 |     @Value("${spring.application.name}")
18 |     String appName;
19 | 
20 |     @Autowired
21 |     ProviderSearchDAO providerSearchDAO;
22 | 
23 |     @GetMapping("/")
24 |     public String index(Model model) {
25 |         model.addAttribute("appName", appName);
26 |         model.addAttribute("noSearch", true);
27 |         return "index";
28 |     }
29 | 
30 |     @PostMapping("/")
31 |     public String search(@RequestParam Map<String, String> body, Model model) {
32 |         model.addAttribute("zipCode", body.get("zipCode"));
33 |         List<Object[]> results = providerSearchDAO.getProvidersInZipCode(body.get("zipCode"));
34 |         model.addAttribute("results", results);
35 |         return "index";
36 |     }
37 | }
38 | 


--------------------------------------------------------------------------------
/src/test/java/com/contrastsecurity/demo/providersearch/ProviderControllerTest.java:
--------------------------------------------------------------------------------
 1 | package com.contrastsecurity.demo.providersearch;
 2 | 
 3 | import static org.assertj.core.api.Assertions.*;
 4 | 
 5 | import java.util.HashMap;
 6 | import java.util.Map;
 7 | import org.junit.Test;
 8 | import org.junit.runner.RunWith;
 9 | import org.springframework.beans.factory.annotation.Autowired;
10 | import org.springframework.boot.test.context.SpringBootTest;
11 | import org.springframework.boot.test.web.client.TestRestTemplate;
12 | import org.springframework.boot.web.server.LocalServerPort;
13 | import org.springframework.http.HttpEntity;
14 | import org.springframework.http.HttpHeaders;
15 | import org.springframework.test.context.junit4.SpringRunner;
16 | import org.springframework.util.LinkedMultiValueMap;
17 | import org.springframework.util.MultiValueMap;
18 | 
19 | @RunWith(SpringRunner.class)
20 | @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
21 | public class ProviderControllerTest {
22 |     @LocalServerPort
23 |     private int port;
24 | 
25 |     @Autowired
26 |     private TestRestTemplate restTemplate;
27 | 
28 |     @Autowired
29 |     private ProviderController controller;
30 | 
31 |     @Test
32 |     public void contextLoads() throws Exception {
33 |         assertThat(controller).isNotNull();
34 |     }
35 | 
36 |     @Test
37 |     public void testProviderSearch() {
38 |         assertThat(
39 |                     this
40 |                     .restTemplate
41 |                     .getForObject("http://localhost:" + port + "/", String.class))
42 |                 .contains("Provider Search");
43 | 
44 |         HttpHeaders headers = new HttpHeaders();
45 |         MultiValueMap<String, String> map= new LinkedMultiValueMap<String, String>();
46 |         map.add("zipCode", "21230");
47 | 
48 |         HttpEntity<MultiValueMap<String, String>> request = new HttpEntity<MultiValueMap<String, String>>(map, headers);
49 | 
50 |         String response = this.restTemplate.postForObject("http://localhost:" + port + "/", request, String.class);
51 | 
52 |         //These two are public
53 |         assertThat(response).contains("Stephen");
54 |         assertThat(response).contains("Jane");
55 | 
56 |         //This one is not
57 |         assertThat(response).doesNotContain("Alfred");
58 |     }
59 | }
60 | 


--------------------------------------------------------------------------------
/pom.xml:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="UTF-8"?>
  2 | <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3 | 	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  4 | 	<modelVersion>4.0.0</modelVersion>
  5 | 
  6 | 	<groupId>com.contrastsecurity.demo</groupId>
  7 | 	<artifactId>provider-search</artifactId>
  8 | 	<version>0.0.1-SNAPSHOT</version>
  9 | 	<packaging>jar</packaging>
 10 | 
 11 | 	<name>provider-search</name>
 12 | 	<description>Demo project for Spring Boot</description>
 13 | 
 14 | 	<parent>
 15 | 		<groupId>org.springframework.boot</groupId>
 16 | 		<artifactId>spring-boot-starter-parent</artifactId>
 17 | 		<version>2.0.2.RELEASE</version>
 18 | 		<relativePath/> <!-- lookup parent from repository -->
 19 | 	</parent>
 20 | 
 21 | 	<properties>
 22 | 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 23 | 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 24 | 		<java.version>1.8</java.version>
 25 | 	</properties>
 26 | 
 27 | 	<dependencies>
 28 | 		<dependency>
 29 | 			<groupId>org.springframework.boot</groupId>
 30 | 			<artifactId>spring-boot-starter-web</artifactId>
 31 | 		</dependency>
 32 | 
 33 | 		<dependency>
 34 | 			<groupId>org.springframework.boot</groupId>
 35 | 			<artifactId>spring-boot-devtools</artifactId>
 36 | 		</dependency>
 37 | 		<dependency>
 38 | 			<groupId>com.h2database</groupId>
 39 | 			<artifactId>h2</artifactId>
 40 | 			<version>1.4.197</version>
 41 | 		</dependency>
 42 | 		<dependency>
 43 | 			<groupId>org.springframework.boot</groupId>
 44 | 			<artifactId>spring-boot-starter-thymeleaf</artifactId>
 45 | 		</dependency>
 46 | 
 47 | 		<!-- For auto-configuration -->
 48 | 		<dependency>
 49 | 			<groupId>org.springframework.boot</groupId>
 50 | 			<artifactId>spring-boot-starter-data-jpa</artifactId>
 51 | 		</dependency>
 52 | 		<dependency>
 53 | 			<groupId>org.springframework.boot</groupId>
 54 | 			<artifactId>spring-boot-starter-test</artifactId>
 55 | 			<scope>test</scope>
 56 | 		</dependency>
 57 | 	</dependencies>
 58 | 
 59 | 	<build>
 60 | 		<plugins>
 61 | 			<plugin>
 62 | 				<groupId>org.springframework.boot</groupId>
 63 | 				<artifactId>spring-boot-maven-plugin</artifactId>
 64 | 			</plugin>
 65 | 		</plugins>
 66 | 	</build>
 67 | 
 68 | 	<profiles>
 69 | 		<profile>
 70 | 			<id>run-with-contrast</id>
 71 | 			<build>
 72 | 				<plugins>
 73 | 					<plugin>
 74 | 						<groupId>com.contrastsecurity</groupId>
 75 | 						<artifactId>contrast-maven-plugin</artifactId>
 76 | 						<version>2.6</version>
 77 | 						<executions>
 78 | 							<execution>
 79 | 								<id>install-contrast-jar</id>
 80 | 								<goals>
 81 | 									<goal>install</goal>
 82 | 								</goals>
 83 | 							</execution>
 84 | 							<execution>
 85 | 								<id>verify-with-contrast</id>
 86 | 								<phase>post-integration-test</phase>
 87 | 								<goals>
 88 | 									<goal>verify</goal>
 89 | 								</goals>
 90 | 							</execution>
 91 | 						</executions>
 92 | 						<configuration>
 93 | 							<username>${env.CONTRAST_MAVEN_USERNAME}</username>
 94 | 							<apiKey>${env.CONTRAST_MAVEN_APIKEY}</apiKey>
 95 | 							<serviceKey>${env.CONTRAST_MAVEN_SERVICEKEY}</serviceKey>
 96 | 							<apiUrl>${env.CONTRAST_MAVEN_TEAMSERVERURL}</apiUrl>
 97 | 							<orgUuid>${env.CONTRAST_MAVEN_ORGUUID}</orgUuid>
 98 | 							<appName>provider-directory</appName>
 99 | 							<serverName>venus</serverName>
100 | 							<serverPath>/provider</serverPath>
101 | 							<minSeverity>Note</minSeverity>
102 | 						</configuration>
103 | 					</plugin>
104 | 				</plugins>
105 | 			</build>
106 | 		</profile>
107 | 	</profiles>
108 | 
109 | </project>
110 | 


--------------------------------------------------------------------------------
/src/main/resources/templates/index.html:
--------------------------------------------------------------------------------
 1 | <html>
 2 |     <head>
 3 |         <title>Home Page</title>
 4 | 
 5 |         <link  href="https://maxcdn.bootstrapcdn.com/bootstrap/4.1.1/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-WskhaSGFgHYWDcbwN70/dfYBj47jz9qbsMId/iRN3ewGhXQFZCSftd1LZCfmhktB" crossorigin="anonymous">
 6 | 
 7 |         <script src="https://code.jquery.com/jquery-3.2.1.slim.min.js" integrity="sha384-KJ3o2DKtIkvYIK3UENzmM7KCkRr/rE9/Qpg6aAZGJwFDMVNA/GpGFF93hXpG5KkN" crossorigin="anonymous"></script>
 8 |         <script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js" integrity="sha384-ApNbgh9B+Y1QKtv3Rn7W3mgPxhU9K/ScQsAP7hUibX39j7fakFPskvXusvfa0b4Q" crossorigin="anonymous"></script>
 9 |         <script src="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js" integrity="sha384-JZR6Spejh4U02d8jOt6vLEHfe/JQGiRRSQQxSfFWpi1MquVdAyjUar5+76PVCmYl" crossorigin="anonymous"></script>
10 | 
11 |         <style th:inline="text">
12 |             body {
13 |                 padding-top: 3.5rem;
14 |             }
15 | 
16 |             .jumbotron {
17 |                 background-image: url([[@{/img/hands.jpg}]]);
18 | 
19 |                 background-size:     cover;
20 |                 background-repeat:   no-repeat;
21 |                 background-position: center center;
22 |             }
23 |         </style>
24 | </style>
25 |     </head>
26 |     <body>
27 | 
28 |         <main role="main">
29 | 
30 |             <!-- Main jumbotron for a primary marketing message or call to action -->
31 |             <div class="jumbotron">
32 |                 <div class="container">
33 |                     <h1 class="display-3">Provider Search</h1>
34 |                     <p>Search our network of distingusihed healthcare professionals to find someone to fit your needs.</p>
35 |                     <!--<p><a class="btn btn-primary btn-lg" href="#" role="button">Get help &raquo;</a></p>-->
36 |                 </div>
37 |             </div>
38 | 
39 |             <div class="container">
40 |                 <form class="form-inline" action="/" method="POST">
41 |                   <div class="form-group mb-2">
42 |                     <label for="staticEmail2" class="sr-only">Email</label>
43 |                     <input type="text" readonly class="form-control-plaintext" id="zipCode" value="Zip code">
44 |                   </div>
45 |                   <div class="form-group mx-sm-3 mb-2">
46 |                     <label for="inputZipCode" class="sr-only">Zip Code</label>
47 |                     <input type="text" class="form-control" id="zipCode" name="zipCode" placeholder="Zip code">
48 |                   </div>
49 |                   <button type="submit" class="btn btn-primary mb-2">Search</button>
50 |                 </form>
51 | 
52 |             </div> <!-- /container -->
53 | 
54 |             <div th:unless="${noSearch} == true" class="container">
55 |                 You searched for zip code: <span th:text="${zipCode}"></span></p>
56 |             </div>
57 | 
58 |             <table th:unless="${noSearch} == true" class="table table-sm">
59 |                 <tr>
60 |                     <th>First Name</th>
61 |                     <th>Last Name</th>
62 |                     <th>Phone</th>
63 |                     <th>Specialty</th>
64 |                     <th>Address</th>
65 |                     <th>City</th>
66 |                     <th>State</th>
67 |                     <th>Zip Code</th>
68 |                 </tr>
69 |                 <tbody class="table-striped">
70 |                     <tr th:each="result : ${results}">
71 |                         <td th:text="${result[1]}"></td>
72 |                         <td th:text="${result[2]}"></td>
73 |                         <td th:text="${result[3]}"></td>
74 |                         <td th:text="${result[8]}"></td>
75 |                         <td th:text="${result[4]}"></td>
76 |                         <td th:text="${result[5]}"></td>
77 |                         <td th:text="${result[6]}"></td>
78 |                         <td th:text="${result[7]}"></td>
79 |                     </tr>
80 |                 </tbody>
81 |             </table>
82 | 
83 |         </main>
84 |     </body>
85 | </html>


--------------------------------------------------------------------------------