Add sensitive data

[appsec-player]

Thank you for submitting a pull request to the WebGoat!

[apiiro-staging]

5 material changes identified by Apiiro:
WORKFLOW - 1 · API is Added:
A new API is added!
Run a security code review. Make sure:

1. Input Validation
2. Authorization
3. Authentication
4. Run a code review make sure there aren't any flaws

• API added (1)
  • GET /access-control/list-users - Line: #64
    View in Apiiro

WORKFLOW - 3 · Sensitive Data Involves in API:
Sensitive data is added to the code repo. It might expose a compliance risk. Make sure it is not written to logs

• PII exposed by an API (1)
  • GET /access-control/list-users - Line: #64
• PII involved in an API (1)
  • GET /access-control/list-users - Line: #64
• PII data written to logs (2)
  • src/main/java/org/owasp/webgoat/lessons/apiiro/utils/UserDetails.java - Line: #13
  • src/main/java/org/owasp/webgoat/lessons/apiiro/utils/UserDetails.java - Line: #13
    View in Apiiro

API Changes

• ⚠ New API GET /access-control/list-users (SensitiveAPILesson.java:64) that is sensitive, unauthenticated and exposing sensitive data
  • ⚠ Sensitive data of type PII involved in the flow of an API method
  • ⚠ Sensitive data of type PII exposed by an API method

Data Model Changes

• ⚠ Sensitive data field firstName (UserDetails.java:13) that is involved in API flow and exposed in API - part of UserDetails data model
  • ⚠ Written to log
• ⚠ Sensitive data field phoneNumber (UserDetails.java:13) that is involved in API flow and exposed in API - part of UserDetails data model
  • ⚠ Written to log