streichsbaer

public class WebApplicationSteps {
  [...]
  public WebApplicationSteps() {
    }
    [..]
    @Given("^a new browser or client instance$")
    public void createAppForAnyClient() {
        createApp();
    }

streichsbaer

@authentication
Feature: Authentication
  Verify that the authentication system is robust
[...]
  @cwe-319-auth
  Scenario: Transmit authentication credentials over HTTPS
    Given a new browser or client instance
    And the client/browser is configured to use an intercepting proxy
    And the proxy logs are cleared
    When the default user logs in

streichsbaer

[...]
net.continuumsecurity.junit.SecurityTest > Scenario: Transmit authentication credentials over HTTPS.Then the protocol should be HTTPS FAILED
    java.lang.AssertionError
[...]    
Report available on: /Users/.../bdd-security/build/reports/cucumber/pretty/feature-overview.html
[...]
BUILD FAILED

streichsbaer

git clone https://github.com/continuumsecurity/bdd-security.git
cd bdd-security
./gradlew -Dcucumber.options="--tags @authentication --tags ~@skip" test

streichsbaer

wget https://raw.githubusercontent.com/continuumsecurity/RopeyTasks/master/ropeytasks.jar?raw=true -O ropeytasks.jar
java -jar ropeytasks.jar

streichsbaer

public void serveResource(ResourceRequest resourceRequest, ResourceResponse resourceResponse) throws IOException, PortletException {
  HttpServletRequest request = PortalUtil.getOriginalServletRequest(PortalUtil.getHttpServletRequest(resourceRequest));
  try {
      HttpServletRequestWrapper wrapper = new HttpServletRequestWrapper(PortalUtil.getHttpServletRequest(resourceRequest)){
          @Override
          public String getParameter(String name) {
              if (name.equals("p_auth")) {
                  return PortalUtil.getOriginalServletRequest((HttpServletRequest) super.getRequest()).getParameter(name);
              }