OWASP / OWASP/SecurityShepherd
[BUG] Mongo setting in setup wizard doesn't affect mongo challenge availability
Open
Nobody has claimed this yet.
Bug
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 515
- Avg merge
- 3h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
The NoSQL injection challenge is still enabled even if the admin doesn't enable the mongo db in the setup wizard.
To Reproduce
Steps to reproduce the behavior:
- Clear the database
- Go to setup wizard
- Fill everything out, but don't check the mongo checkbox
- The NoSQL challenge is enabled
- The challenge can't be completed because the database isn't available.
Expected behavior
The nosql injection challenge should be disabled
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the setup wizard flow: clear the database, leave the Mongo checkbox unchecked, and confirm that the NoSQL injection challenge remains enabled. Trace how the Mongo setting controls challenge availability, then verify that the challenge is disabled when MongoDB is not enabled and remains available when it is enabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, mongodb
- Domain
- backend, databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100