bug(website): legacyCardCodeFix corrupts Digital Benefits Deck (dbd) SCOPE (SCO*) and CORNUCOPIA (COR*) card codes

オープン
  • 何か問題がありますか？
#3,784 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
52/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
typescript, yaml
領域
backend

調査の方向性

Read the four listed +page.server.ts route loaders and legacyCardCodeFix, then compare their lookup flow with source/dbd-cards-1.0-en.yaml and the dbd entry in cornucopia.owasp.org/application.yaml. Check how existing card IDs and legacy webapp codes are resolved. Done means the listed SCOPE and CORNUCOPIA IDs resolve correctly and regression tests cover the behavior.

索引モデルが issue の本文から書いたものです。

説明

Describe the bug

In cornucopia.owasp.org, all four card route server loaders apply legacyCardCodeFix unconditionally before looking up a card in the deck:

  • cornucopia.owasp.org/src/routes/cards/[card]/+page.server.ts (lines 19, 58–64)
  • cornucopia.owasp.org/src/routes/edition/[edition]/[card]/+page.server.ts (lines 24, 59–61)
  • cornucopia.owasp.org/src/routes/edition/[edition]/[card]/[version]/+page.server.ts (lines 28, 67–69)
  • cornucopia.owasp.org/src/routes/edition/[edition]/[card]/[version]/[lang]/+page.server.ts (lines 28, 66–68)
function legacyCardCodeFix(card: string) {
  return card
    .replace("COM", "CM")
    .replace("CO", "C")
    .replace("DVE", "VE")
    .replace("AC", "AT");
}

Because .replace("CO", "C") performs an unanchored substring replacement on every card ID across all editions, it corrupts all 26 cards in the SCOPE (SCO2–SCOA) and CORNUCOPIA (COR2–CORA) suits of the Digital Benefits Deck (dbd, configured in cornucopia.owasp.org/application.yaml and source/dbd-cards-1.0-en.yaml):

  • SCO2–SCOA are rewritten to SC2–SCA (e.g. "SCO2".replace("CO", "C") === "SC2"), which do not exist in dbd or any other deck. Visiting /cards/SCO2 throws an HTTP 404, and visiting /edition/dbd/SCO2, /edition/dbd/SCO2/1.0, or /edition/dbd/SCO2/1.0/en fails to find the card in cards (card is undefined, rendering CardNotFound).
  • COR2–CORA are rewritten to CR2–CRA (e.g. "COR2".replace("CO", "C") === "CR2"). Visiting /edition/dbd/COR2 fails to resolve the dbd card, and visiting /cards/COR2 silently resolves to the webapp edition's Cryptography CR2 card instead of dbd's COR2 card.
Proof / Reproduction

Running against source/dbd-cards-1.0-en.yaml (where SCOPE has IDs SCO2–SCOA and CORNUCOPIA has IDs COR2–CORA):

Input card ID: "SCO2" -> legacyCardCodeFix("SCO2") => "SC2"  (cards.get("SC2") === undefined in dbd and all decks -> 404 / CardNotFound)
Input card ID: "COR2" -> legacyCardCodeFix("COR2") => "CR2"  (cards.get("CR2") === undefined in dbd; resolves to webapp CR2 on /cards/COR2)

All 26 affected card IDs in source/dbd-cards-1.0-en.yaml:
SCO2, SCO3, SCO4, SCO5, SCO6, SCO7, SCO8, SCO9, SCOX, SCOJ, SCOQ, SCOK, SCOA, COR2, COR3, COR4, COR5, COR6, COR7, COR8, COR9, CORX, CORJ, CORQ, CORK, CORA.

Expected Behavior

legacyCardCodeFix should only map legacy webapp card prefixes (COM, CO, DVE, AC at the start of the code when the raw card code is not present in the target cards map, or only when ^(COM|CO|DVE|AC)(10|[2-9XJQKA])$ matches) so valid dbd card codes (SCO*, COR*) are not corrupted.

Hi @sydseter, could you please assign this issue to me? I'd be happy to submit a PR fixing this with unit tests.

主要言語
Python
スター
158
フォーク
110
平均マージ
1日 11時間
マージ済み PR（30日）
115

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

OWASP/cornucopia のほかの issue

OWASP/cornucopia の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。