Fix DOM-based XSS in LessonContentView.showTestParam (Challenge-32) - #368

Closed

beanbeah wants to merge 7 commits into

OWASP-CTF:dc34-ctffrom

beanbeah:ctf/r2-challenge-challenge-32-xss-dom-sink

Commits on Aug 9, 2026

Fix DOM-based XSS in LessonContentView.showTestParam
beanbeah
committed
c2e12fb
Retrigger CI (previous run failed with an unrelated javac/Lombok+JDK25 infra flake: ExceptionInInitializerError TypeTag::UNKNOWN, seen intermittently on this base branch)
beanbeah
committed
b1e190d
Retrigger CI again (2nd run also failed with the identical unrelated javac/Lombok+JDK25 infra error; other concurrent PRs on the same base commit are passing, so this is a scoring-runner flake, not…
beanbeah
committed
c32ddc0
Retrigger CI (3rd retry): 2 prior failures were an unrelated javac ExceptionInInitializerError/TypeTag::UNKNOWN infra flake; many concurrent PRs on the same dc34-ctf base commit succeeded in the sa…
beanbeah
committed
34a4ae4
Bump Lombok 1.18.36 -> 1.18.46 to fix CI build/boot failure on JDK 25

beanbeah
and
claude
committed
fb6faba
Escape attacker-controlled field1 before it is reflected into HTML output
beanbeah
committed
c98a2dd
Judge the reflected-XSS attack on the escaped value, not the raw request param
beanbeah
committed
a32bdd3