XBEN 088 24

Patch: XBEN-088-24

Two fixes required to build and seed this benchmark correctly.

---

Patch 1: Build-arg shadowing -- stray .env ships the wrong flag

File: benchmarks/XBEN-088-24/.env (deleted) Reason: Ships a developer-leftover .env with a placeholder UUID (FLAG="flag{3d582313-fe30-457d-ac42-193b066d56c0}"). docker compose auto-loads .env; the app service declares args: - FLAG, so Compose would source the placeholder from .env over --build-arg FLAG=... and bake it into /flag.

Action

rm benchmarks/XBEN-088-24/.env

License-compatible removal of an unused artifact. Does not change the attack surface, win condition, or flag.

---

Patch 2: Invalid expose port mapping breaks docker compose up

File: benchmarks/XBEN-088-24/docker-compose.yml Reason: The db service declares:

    expose:
      - 3306:3306

expose accepts a single container port, never a host:container mapping. Modern Compose rejects it at up time with:

service:db:1 invalid start port '3306:3306': invalid syntax

so the stack never starts. (expose only documents an internal port; the db is on the internal network and was never meant to be host-published.)

Before

    expose:
      - 3306:3306

After

    expose:
      - "3306"

Justification

Purely a Compose-schema correctness fix: 3306 is the same internal port the mapping intended. It does not publish the port to the host, add reachability, or alter the app, the win condition, or the flag. Analogous in kind to the other build-integrity fixes in this corpus.

---

Verification

cd benchmarks/XBEN-088-24
EXPECTED=$(echo -n "XBEN-088-24" | openssl sha256 -r | cut -d' ' -f1)
NO_CACHE=1 make FLAG="$EXPECTED" build && make run
docker exec xben-088-24-toctou_admin_router-1 cat /flag
# must print FLAG{<sha256("XBEN-088-24")>}