Skip to content

chore: bump the maven group across 1 directory with 2 updates #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 3 commits into
base: main
Choose a base branch
from
Open

chore: bump the maven group across 1 directory with 2 updates #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2a7bde3
chore: bump the maven group across 1 directory with 2 updates
dependabot[bot] Apr 21, 2026
559af06
fix: allow vulnerable-components lesson to deserialize with xstream 1…
Copilot Apr 22, 2026
e5410ec
docs: clarify intentional insecure xstream permission in lesson code
Copilot Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@
<java.version>25</java.version>
<jaxb.version>2.3.1</jaxb.version>
<jjwt.version>0.9.1</jjwt.version>
<jose4j.version>0.9.3</jose4j.version>
<jose4j.version>0.9.6</jose4j.version>
<jquery.version>3.7.1</jquery.version>
<jsoup.version>1.19.1</jsoup.version>
<maven-compiler-plugin.version>3.14.0</maven-compiler-plugin.version>
Expand Down Expand Up @@ -105,7 +105,7 @@
<webwolf.port>9090</webwolf.port>
<wiremock.version>3.13.1</wiremock.version>
<xml-resolver.version>1.2</xml-resolver.version>
<xstream.version>1.4.5</xstream.version>
<xstream.version>1.4.21</xstream.version>

Copilot AI Apr 22, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bumping XStream from 1.4.5 to 1.4.21 may break the “Vulnerable Components” lesson, which explicitly guides users to exploit CVE-2013-7285 via XStream deserialization (see src/main/resources/lessons/vulnerablecomponents/... and GeneralLessonIntegrationTest#vulnerableComponents). Please verify the exploit path still works in the Docker scenario; if not, consider pinning a vulnerable XStream specifically for that lesson (module/profile/shaded dep) or updating the lesson content/tests accordingly. Also note config/dependency-check/project-suppression.xml currently suppresses many XStream CVEs for all versions; after this bump, that suppression may be overly broad and could hide real findings.

Suggested change
<xstream.version>1.4.21</xstream.version>
<!-- intentionally pinned: the Vulnerable Components lesson and its integration test rely on the historical XStream exploit path -->
<xstream.version>1.4.5</xstream.version>

Copilot uses AI. Check for mistakes.
<!-- do not update necessary for lesson -->
<zxcvbn.version>1.9.0</zxcvbn.version>
</properties>
Expand Down
3 changes: 3 additions & 0 deletions src/main/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLesson.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
import static org.owasp.webgoat.container.assignments.AttackResultBuilder.success;

import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.security.AnyTypePermission;
import org.apache.commons.lang3.StringUtils;
import org.owasp.webgoat.container.assignments.AssignmentEndpoint;
import org.owasp.webgoat.container.assignments.AssignmentHints;
Expand All @@ -24,6 +25,8 @@ public class VulnerableComponentsLesson implements AssignmentEndpoint {
@PostMapping("/VulnerableComponents/attack1")
public @ResponseBody AttackResult completed(@RequestParam String payload) {
XStream xstream = new XStream();
// Intentionally insecure for this lesson to demonstrate vulnerable deserialization behavior.
xstream.addPermission(AnyTypePermission.ANY);
xstream.setClassLoader(Contact.class.getClassLoader());
xstream.alias("contact", ContactImpl.class);
xstream.ignoreUnknownElements();
Expand Down
7 changes: 7 additions & 0 deletions ...t/java/org/owasp/webgoat/lessons/vulnerablecomponents/VulnerableComponentsLessonTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@

import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.io.StreamException;
import com.thoughtworks.xstream.security.AnyTypePermission;
import org.junit.jupiter.api.Disabled;
import org.junit.jupiter.api.Test;

Expand All @@ -31,6 +32,8 @@ public class VulnerableComponentsLessonTest {
@Test
public void testTransformation() throws Exception {
XStream xstream = new XStream();
// Intentionally insecure for this lesson to validate vulnerable deserialization behavior.
xstream.addPermission(AnyTypePermission.ANY);
xstream.setClassLoader(Contact.class.getClassLoader());
xstream.alias("contact", ContactImpl.class);
xstream.ignoreUnknownElements();
Expand All @@ -41,6 +44,8 @@ public void testTransformation() throws Exception {
@Disabled
public void testIllegalTransformation() throws Exception {
XStream xstream = new XStream();
// Intentionally insecure for this lesson to validate vulnerable deserialization behavior.
xstream.addPermission(AnyTypePermission.ANY);
xstream.setClassLoader(Contact.class.getClassLoader());
xstream.alias("contact", ContactImpl.class);
xstream.ignoreUnknownElements();
Expand All @@ -54,6 +59,8 @@ public void testIllegalTransformation() throws Exception {
@Test
public void testIllegalPayload() throws Exception {
XStream xstream = new XStream();
// Intentionally insecure for this lesson to validate vulnerable deserialization behavior.
xstream.addPermission(AnyTypePermission.ANY);
xstream.setClassLoader(Contact.class.getClassLoader());
xstream.alias("contact", ContactImpl.class);
xstream.ignoreUnknownElements();
Expand Down
Loading