Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[🐛] Bug or change the behavior of the function 'fetchCodeSnippets' #112

Closed
digitalarche opened this issue Sep 14, 2021 · 2 comments
Closed
Labels

Comments

@digitalarche
Copy link

🐛 Bug report

Description

the problem is easy and not for CTF Extension I think that it is a bug on JuiceShop itself.
The Api Snippets give this out file Json with threes bad entries and I try it more 5 times and it's the same.

In juiceShopUrl + '/snippets'

{
"challenges": [
"directoryListingChallenge",
"accessLogDisclosureChallenge",
"resetPasswordMortyChallenge",
"changeProductChallenge",
"registerAdminChallenge",
"exposedMetricsChallenge",
"fileWriteChallenge",
"loginAdminChallenge",
"loginBenderChallenge",
"loginJimChallenge",
"unionSqlInjectionChallenge",
"dbSchemaChallenge",
"noSqlReviewsChallenge",
"forgedReviewChallenge",
"noSqlCommandChallenge",
"nippet",
"start",
".*/",
"redirectCryptoCurrencyChallenge",
"redirectChallenge",
"adminSectionChallenge",
"scoreBoardChallenge",
"tokenSaleChallenge",
"resetPasswordBjoernOwaspChallenge",
"resetPasswordBjoernChallenge",
"resetPasswordJimChallenge",
"resetPasswordBenderChallenge",
"resetPasswordUvoginChallenge",
"passwordRepeatChallenge",
"restfulXssChallenge",
"localXssChallenge",
"xssBonusChallenge"
]
}

This is not good :
"nippet",
"start",
".*/",

🔬 Minimal Reproduction

@github-actions
Copy link

Thanks a lot for opening your first issue with us! 🧡 We'll get back to you shortly! ⏳ If it was a Support Request, please check our extensive CTF manual first. Also, please consider asking on the community chat next time! 💬

@bkimminich
Copy link
Member

This should not impact the CTF tool in any way, or does it? Shouldn't create broken challenges or anything.

This happens due to some parsing craziness happening in Juice Shop to find those snippets. It doesn't hurt in there either, but it'd be cleaner to filter the API response to only contain entries ending in "Challenge" which would make this go away.

bkimminich added a commit to juice-shop/juice-shop that referenced this issue Sep 15, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants