bug(website): legacyCardCodeFix corrupts Digital Benefits Deck (dbd) SCOPE (SCO*) and CORNUCOPIA (COR*) card codes

Aperta
  • Qualcosa non va?
#3,784 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
52/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
typescript, yaml
Ambito
backend

Direzione di ricerca

Read the four listed +page.server.ts route loaders and legacyCardCodeFix, then compare their lookup flow with source/dbd-cards-1.0-en.yaml and the dbd entry in cornucopia.owasp.org/application.yaml. Check how existing card IDs and legacy webapp codes are resolved. Done means the listed SCOPE and CORNUCOPIA IDs resolve correctly and regression tests cover the behavior.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Describe the bug

In cornucopia.owasp.org, all four card route server loaders apply legacyCardCodeFix unconditionally before looking up a card in the deck:

  • cornucopia.owasp.org/src/routes/cards/[card]/+page.server.ts (lines 19, 58–64)
  • cornucopia.owasp.org/src/routes/edition/[edition]/[card]/+page.server.ts (lines 24, 59–61)
  • cornucopia.owasp.org/src/routes/edition/[edition]/[card]/[version]/+page.server.ts (lines 28, 67–69)
  • cornucopia.owasp.org/src/routes/edition/[edition]/[card]/[version]/[lang]/+page.server.ts (lines 28, 66–68)
function legacyCardCodeFix(card: string) {
  return card
    .replace("COM", "CM")
    .replace("CO", "C")
    .replace("DVE", "VE")
    .replace("AC", "AT");
}

Because .replace("CO", "C") performs an unanchored substring replacement on every card ID across all editions, it corrupts all 26 cards in the SCOPE (SCO2–SCOA) and CORNUCOPIA (COR2–CORA) suits of the Digital Benefits Deck (dbd, configured in cornucopia.owasp.org/application.yaml and source/dbd-cards-1.0-en.yaml):

  • SCO2–SCOA are rewritten to SC2–SCA (e.g. "SCO2".replace("CO", "C") === "SC2"), which do not exist in dbd or any other deck. Visiting /cards/SCO2 throws an HTTP 404, and visiting /edition/dbd/SCO2, /edition/dbd/SCO2/1.0, or /edition/dbd/SCO2/1.0/en fails to find the card in cards (card is undefined, rendering CardNotFound).
  • COR2–CORA are rewritten to CR2–CRA (e.g. "COR2".replace("CO", "C") === "CR2"). Visiting /edition/dbd/COR2 fails to resolve the dbd card, and visiting /cards/COR2 silently resolves to the webapp edition's Cryptography CR2 card instead of dbd's COR2 card.
Proof / Reproduction

Running against source/dbd-cards-1.0-en.yaml (where SCOPE has IDs SCO2–SCOA and CORNUCOPIA has IDs COR2–CORA):

Input card ID: "SCO2" -> legacyCardCodeFix("SCO2") => "SC2"  (cards.get("SC2") === undefined in dbd and all decks -> 404 / CardNotFound)
Input card ID: "COR2" -> legacyCardCodeFix("COR2") => "CR2"  (cards.get("CR2") === undefined in dbd; resolves to webapp CR2 on /cards/COR2)

All 26 affected card IDs in source/dbd-cards-1.0-en.yaml:
SCO2, SCO3, SCO4, SCO5, SCO6, SCO7, SCO8, SCO9, SCOX, SCOJ, SCOQ, SCOK, SCOA, COR2, COR3, COR4, COR5, COR6, COR7, COR8, COR9, CORX, CORJ, CORQ, CORK, CORA.

Expected Behavior

legacyCardCodeFix should only map legacy webapp card prefixes (COM, CO, DVE, AC at the start of the code when the raw card code is not present in the target cards map, or only when ^(COM|CO|DVE|AC)(10|[2-9XJQKA])$ matches) so valid dbd card codes (SCO*, COR*) are not corrupted.

Hi @sydseter, could you please assign this issue to me? I'd be happy to submit a PR fixing this with unit tests.

Lingua principale
Python
Stelle
158
Fork
110
Merge medio
1g 11h
PR unite (30g)
115

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di OWASP/cornucopia

Tutte le issue di OWASP/cornucopia

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.