OWASP / OWASP/SecurityShepherd

[BUG] Misleading checkbox "Enable unsafe levels" on page "Get Started"

Open
#712 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug
Dominant language
Java
Stars
1.5k
Forks
515
Avg merge
3h 46m
Merged PRs (30d)
1

Description

IMHO, the checkbox "Enable unsafe levels" on the Get Started page is misleading, because it is effective for the buttons on this page only.
If you (like I did) first close all modules and then open single categories in OpenFloor mode, then e.g. for the category "Injection" also the unsafe XXE modules are opened without being warned. Not knowing how the lessons/challenges are implemented (simulation or for real), it is impossible to estimate if they are safe or not.

Therefore my suggestions :

  • the decision about unsafe modules should be memorized in table core.settings
  • the checkbox should also be present on pages Open/Close Modules and Open/Close Categories; depending on it unsafe modules could be listed or not (in case of Open/Close Modules) or not opened (in case of Open/Close Categories).
  • unsafe modules in module listings could be marked with a star at the end of their names

BTW: there's a Discussions tab here in GitHub. I wanted to present these considerations there first, but it seems the discussion section is not (yet) used in this project.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Inspect the Get Started, Open/Close Modules, and Open/Close Categories pages, then review the core.settings table to understand how unsafe-module choices are handled. Define the intended persistence, filtering, warning, and naming behavior across those pages; done means the unsafe-level decision is consistent and unsafe modules are clearly identified.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
full-stack
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.