Solution #3: Dice
·
9 commits
to main
since this release
The official solution to Challenge #3: Dice.
Covers the correct answer, why the (absent) auth model is a red herring, the full application code flow, the threat model with mitigation review, complete exploitation steps (fullwidth ＜img onerror＞ reviving a stripped tag), the fix, CWE grounding (CWE-79 XSS via CWE-180 "Validate Before Canonicalize", rooted in CWE-176 Unicode handling), and real-world grounding (DOMPurify's own "do not modify the output" rule + Unicode normalization security guidance).
- Read it in the repo:
solutions/003-dice/SOLUTION.md - Also attached below as a standalone file.
No spoilers were posted anywhere before this release — thanks to everyone who worked through it privately. Discussion is welcome now that it's out.