OWASP / OWASP/SecurityShepherd
[BUG] Misleading checkbox "Enable unsafe levels" on page "Get Started"
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 515
- Avg merge
- 3h 46m
- Merged PRs (30d)
- 1
Description
IMHO, the checkbox "Enable unsafe levels" on the Get Started page is misleading, because it is effective for the buttons on this page only.
If you (like I did) first close all modules and then open single categories in OpenFloor mode, then e.g. for the category "Injection" also the unsafe XXE modules are opened without being warned. Not knowing how the lessons/challenges are implemented (simulation or for real), it is impossible to estimate if they are safe or not.
Therefore my suggestions :
- the decision about unsafe modules should be memorized in table
core.settings - the checkbox should also be present on pages
Open/Close ModulesandOpen/Close Categories; depending on it unsafe modules could be listed or not (in case ofOpen/Close Modules) or not opened (in case ofOpen/Close Categories). - unsafe modules in module listings could be marked with a star at the end of their names
BTW: there's a Discussions tab here in GitHub. I wanted to present these considerations there first, but it seems the discussion section is not (yet) used in this project.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the Get Started, Open/Close Modules, and Open/Close Categories pages, then review the core.settings table to understand how unsafe-module choices are handled. Define the intended persistence, filtering, warning, and naming behavior across those pages; done means the unsafe-level decision is consistent and unsafe modules are clearly identified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- full-stack
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100