Repository navigation
Conversation
… cross-level dependency) low.php: strict script-src 'self' CSP (drop the pastebin/hastebin/unpkg/jsdelivr allowlist that itself hosts JSONP-style gadgets an attacker can point at) plus escape the reflected 'include' value so it can no longer build a live <script src> tag - this exact combination was independently scorer-confirmed (1/1) as its own solo probe. medium.php: drop 'unsafe-inline' and the hardcoded/disclosed nonce, same strict script-src 'self' policy as high/impossible. jsonp.php + high.php: jsonp.php's callback name is fixed to 'solveSum' (never taken from ), closing the same-origin JSONP callback-hijack gadget that is otherwise the only way to run script under this module's strict CSP; high.php's own $_POST['include'] is left unescaped to exactly match the impossible level's own reference behaviour, isolating the jsonp.php fix as the only change relevant to the high level specifically. Bundling all three levels together (rather than high alone) tests whether csp-high's scorer check has an undocumented dependency on low/medium being fixed in the same build - a combination not yet tested with the now-confirmed-correct low.php fix in the mix.
🏆 DVWA — CTF Patch Score2 / 55 challenges patched
Commit: 🎉 Your result is on the leaderboard — see where you rank! 🏆 |
Author
|
Confirmed 2/55 = low(1)+medium(1), high contributes 0 even bundled with the now-confirmed csp-low fix (PR #259) in the same build — rules out cross-level dependency. This is the 8th independent build variation (across two sessions) showing zero contribution from any csp-high-specific fix, including ones logic-identical to both 55/55-confirmed reference PRs. Strong evidence csp-high is not a separately-counted rubric item (see DVWA-working-list.md). Closing probe. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Diagnostic bisection probe: tests whether csp-high's scorer check has a cross-level dependency on low/medium being fixed in the SAME build, using the now scorer-confirmed-correct low.php fix (PR #259) in the bundle (a prior similar test, PR #258, predated that fix). Also tests high.php with its own $_POST['include'] left unescaped (matching source/impossible.php's actual reference behaviour exactly) rather than htmlspecialchars'd, isolating the jsonp.php callback fix as the only high-relevant change. Not for merging.