Introduce separate configuration for challenges #1083

nbaars · 2023-11-17T13:03:55Z

This PR split the configuration of a challenge into two parts:

Challenge definition
Challenge (the actual code)

Each definition can link to 1 or more challenges. This makes it possible to have different implementations and documentation for each environment. For example:

   - name: Challenge 5
      url: "challenge-5"
      sources:
        - class-name: "org.owasp.wrongsecrets.challenges.kubernetes.Challenge5"
          explanation: "explanations/challenge5.adoc"
          hint: "explanations/challenge5_hint.adoc"
          reason: "explanations/challenge5_reason.adoc"
          environments: [ *k8s, *k8s_vault ]
        - class-name: "org.owasp.wrongsecrets.challenges.kubernetes.Challenge5"
          explanation: "explanations/challenge5.adoc"
          hint: "explanations/challenge5_hint_limited.adoc"
          reason: "explanations/challenge5_reason.adoc"
          environments: [ *okteto ]
      difficulty: *normal
      category: *config_maps
      ctf:
        enabled: true

This example shows how we can define for different environments different hints. This also makes it possible to have a different Challenge class per environment.

The configuration for the application is also part of the yaml configuration. For example, the environments, difficulty levels are now defined in the yaml file:

  difficulties:
    - &easy "easy"
    - &normal "normal"
    - &hard "hard"
    - &expert "expert"
    - &master "master"

Adding a new difficulty level is as easy as adding a new entry in this yaml section. No code changes are necessary to add a new difficulty level. Same applies for categories and environments it only needs a config update.

The UI now treats every challenge the same. No more specific "challenge" code leaks into the main part of the application.

The order of the challenges is now defined by the configuration file, if you want to change the order you can simply change the order in the yaml file. Also if you want to run WrongSecrets with a couple of challenges only need to change the yaml file.

** Performance **

Starting time locally is now:

o.o.w.WrongSecretsApplication            : Started WrongSecretsApplication in 1.978 seconds (process running for 2.312)

The memory consumption is around 90 Mb

Closes #502

pom.xml

src/main/java/org/owasp/wrongsecrets/RuntimeEnvironment.java

src/main/java/org/owasp/wrongsecrets/challenges/Challenge.java

src/main/java/org/owasp/wrongsecrets/definitions/ChallengeName.java

.github/scripts/.bash_history

This is now configurable, so we can define different documentation for different environments.

commjoen

Review in progress, first looks: pretty good! Thank you @nbaars !

commjoen · 2023-11-19T06:50:06Z

Spotbugs spits out a few errors at https://github.com/OWASP/wrongsecrets/actions/runs/6909060649/job/18799652205?pr=1083: can you please have a look good sir?

pom.xml

.github/scripts/.bash_history

.github/workflows/link_checker.yml

.github/workflows/minikube-k8s-test.yml

CONTRIBUTING.md

src/main/java/org/owasp/wrongsecrets/Challenges.java

src/main/java/org/owasp/wrongsecrets/FailtoStartupException.java

commjoen · 2023-11-20T09:27:49Z

src/main/java/org/owasp/wrongsecrets/InMemoryScoreCard.java

  }

  @Override
  public int getTotalReceivedPoints() {
    return solvedChallenges.stream()
-        .map(challenge -> challenge.difficulty() * (100 + (challenge.difficulty() - 1) * 25))
+        .map(


should we maybe just cache this value? it's just an int right?

src/main/java/org/owasp/wrongsecrets/StartupListener.java

src/main/java/org/owasp/wrongsecrets/challenges/ChallengesController.java

.github/scripts/.bash_history

RemakingEden · 2023-11-20T10:42:32Z

So Ive just been running the tests locally.

Positives

They are so much neater and less hacky in the new place
After a really long set up they run really quickly each time after

Negatives/questions

It is a little hard to tell what has failed.
How does a user get to the visual debugger?
Is it possible to still upload screenshots and videos?

RemakingEden · 2023-11-20T10:45:42Z

.github/workflows/main.yml

@@ -48,15 +48,6 @@ jobs:
        with:


Does this whole ui-test section need removing?

Yes, it is now part of the normal tests. You can run it as a normal unit-test with different Spring Boot configurations per Cypress test if necessary

The tests are still there they are now part of the normal tests

Oh yeah sorry, I was saying that so far you have just deleted a step in the ui-test section. I think the whole "ui-test:" object needs removing

A challenge has a name and a short name, which can be used in URLs etc. Using `shortName` instead of `url` makes more sense.

Next on last challenge should be disabled.

Link now points to the right URL and added a Cypress test to verify clicking the link.

Since we only need the contents in the CTF controller we can make this a bit more lazy.

nbaars · 2023-11-21T20:35:20Z

So Ive just been running the tests locally.

Positives

They are so much neater and less hacky in the new place

After a really long set up they run really quickly each time after

Negatives/questions

It is a little hard to tell what has failed.

How does a user get to the visual debugger?

The screenshots are saved, you can also run the Cypress test directly from Intellij.

Is it possible to still upload screenshots and videos?
The screenshots are still saved in src/test/e2e/cypress/screenshots. For example:

commjoen · 2023-11-22T08:42:18Z

Re #1083 (comment): can we maybe have the "howto" added to the contributing.md ;) ?

RemakingEden · 2023-11-23T09:33:03Z

Re #1083 (comment): can we maybe have the "howto" added to the contributing.md ;) ?

Yeah I think something to explain this to new users and we will be away! Apart from those answered concerns I think everything is an improvement. It feels loads cleaner!!

commjoen · 2023-11-30T05:17:45Z

@nbaars can you please have a look at the remaining issues at https://github.com/OWASP/wrongsecrets/actions/runs/6948950794/job/18906041764?pr=1083 so we can merge and fix more bugs in separate PRs?

commjoen · 2023-12-05T05:13:19Z

Created #1105 for future improvements once this is merged

RemakingEden · 2023-12-05T19:31:41Z

src/test/e2e/reporter-config.json

+{
+    "reporterEnabled": "spec, mochawesome",
+    "mochawesomeReporterOptions": {
+        "reportDir": "cypress/reports/mochawesome",


I don't seem to be getting this mochawsome report when I run the tests. Should a report appear this in this path after each run?

Weirdly I am also still not seeing screenshots on a failure

This is my path after a failure

RemakingEden · 2023-12-05T19:48:09Z

src/test/e2e/cypress/README.md

@@ -4,14 +4,15 @@ This project uses [Cypress](https://www.cypress.io/) to run UI tests for the pro

 ## How to run the tests


I think a new section in here about how to use the visual debugger is important. Unless this is possible with maven. So we have one method of using it quickly and easily through unit tests and one way that is a little harder to run but way easier to debug visually. If youd like im happy to add this.

Can you add this to #1105 please :-)?

bendehaan

Great improvements here, thanks a lot! 😁

commjoen

Thank you @nbaars for another big step forward! Now we can parallelize development of new challenges and do other improvements!

nbaars requested review from commjoen and bendehaan as code owners November 17, 2023 13:03

refactor: configure a challenge in a configuration file.

04ee7c2

nbaars force-pushed the nbaars/config-challenges branch from 645f0c9 to 04ee7c2 Compare November 17, 2023 13:07

[pre-commit.ci lite] apply automatic fixes

d800df5

nbaars commented Nov 17, 2023

View reviewed changes

pom.xml Show resolved Hide resolved

nbaars commented Nov 17, 2023

View reviewed changes

src/main/java/org/owasp/wrongsecrets/RuntimeEnvironment.java Show resolved Hide resolved

nbaars commented Nov 17, 2023

View reviewed changes

src/main/java/org/owasp/wrongsecrets/challenges/Challenge.java Show resolved Hide resolved

github-advanced-security bot found potential problems Nov 17, 2023

View reviewed changes

src/main/java/org/owasp/wrongsecrets/definitions/ChallengeName.java Fixed Show fixed Hide fixed

nbaars commented Nov 17, 2023

View reviewed changes

.github/scripts/.bash_history Outdated Show resolved Hide resolved

Nanne Baars and others added 7 commits November 17, 2023 14:13

refactor: remove license information

47dcdc0

documentation: remove isLimittedWhenOnlineHosted

b643eb4

This is now configurable, so we can define different documentation for different environments.

[pre-commit.ci lite] apply automatic fixes

40d9943

chore: fix Checkstyle errors

8105ff3

[pre-commit.ci lite] apply automatic fixes

64515af

chore: fix ESLint error

2f06e55

chore: fix ESLint error

3ca0af1

nbaars force-pushed the nbaars/config-challenges branch from ceb5b58 to 3ca0af1 Compare November 17, 2023 19:31

pre-commit-ci-lite bot and others added 5 commits November 17, 2023 19:33

[pre-commit.ci lite] apply automatic fixes

e52162a

chore: fix challenge name matching

cc52594

[pre-commit.ci lite] apply automatic fixes

7fb373a

chore: remove matching

5c389d3

chore: remove separate Cypress step

a955af0

commjoen reviewed Nov 17, 2023

View reviewed changes

Nanne Baars added 2 commits November 17, 2023 22:05

chore: fix failing test

2b38acf

chore: fix deprecation warning link-checker

66d8ebc

commjoen requested changes Nov 20, 2023

View reviewed changes

Update POM file with new version: 1.8.0RC1

093b625

RemakingEden reviewed Nov 20, 2023

View reviewed changes

.github/scripts/.bash_history Outdated Show resolved Hide resolved

RemakingEden reviewed Nov 20, 2023

View reviewed changes

Nanne Baars and others added 7 commits November 20, 2023 21:05

chore: use shortName instead of url

418e6ce

A challenge has a name and a short name, which can be used in URLs etc. Using `shortName` instead of `url` makes more sense.

chore: fix navigation.

47ec917

Next on last challenge should be disabled.

chore: fix spoiler link on welcome page.

1ac6940

Link now points to the right URL and added a Cypress test to verify clicking the link.

chore: load contents on demand.

8a2680d

Since we only need the contents in the CTF controller we can make this a bit more lazy.

feature: add Gatling performance test.

bb8c787

[pre-commit.ci lite] apply automatic fixes

edf1b7b

Update POM file with new version: 1.8.0RC2

9440d29

Nanne Baars and others added 4 commits December 4, 2023 22:01

feature: fix startup message when env is not set.

7051dc7

chore: fix SpotBugs errors

6105ad2

Merge branch 'master' into nbaars/config-challenges

e0e2489

[pre-commit.ci lite] apply automatic fixes

9fb2fa7

RemakingEden reviewed Dec 5, 2023

View reviewed changes

bendehaan approved these changes Dec 6, 2023

View reviewed changes

commjoen approved these changes Dec 6, 2023

View reviewed changes

commjoen merged commit 5382f31 into master Dec 6, 2023
13 of 15 checks passed

commjoen deleted the nbaars/config-challenges branch December 6, 2023 09:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Introduce separate configuration for challenges #1083

Introduce separate configuration for challenges #1083

nbaars commented Nov 17, 2023 •

edited by commjoen

Loading

commjoen left a comment

commjoen commented Nov 19, 2023

commjoen Nov 20, 2023

RemakingEden commented Nov 20, 2023 •

edited

Loading

RemakingEden Nov 20, 2023

nbaars Nov 20, 2023

nbaars Nov 20, 2023

RemakingEden Nov 20, 2023

nbaars commented Nov 21, 2023

commjoen commented Nov 22, 2023

RemakingEden commented Nov 23, 2023

commjoen commented Nov 30, 2023

commjoen commented Dec 5, 2023

RemakingEden Dec 5, 2023

RemakingEden Dec 5, 2023

RemakingEden Dec 5, 2023

RemakingEden Dec 5, 2023

commjoen Dec 6, 2023

bendehaan left a comment

commjoen left a comment

		@@ -4,14 +4,15 @@ This project uses [Cypress](https://www.cypress.io/) to run UI tests for the pro

		## How to run the tests

Introduce separate configuration for challenges #1083

Introduce separate configuration for challenges #1083

Conversation

nbaars commented Nov 17, 2023 • edited by commjoen Loading

commjoen left a comment

Choose a reason for hiding this comment

commjoen commented Nov 19, 2023

Choose a reason for hiding this comment

RemakingEden commented Nov 20, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nbaars commented Nov 21, 2023

commjoen commented Nov 22, 2023

RemakingEden commented Nov 23, 2023

commjoen commented Nov 30, 2023

commjoen commented Dec 5, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bendehaan left a comment

Choose a reason for hiding this comment

commjoen left a comment

Choose a reason for hiding this comment

nbaars commented Nov 17, 2023 •

edited by commjoen

Loading

RemakingEden commented Nov 20, 2023 •

edited

Loading