Hint request: Secure Coding Fundamentals Badge

Issues & Feature Request
1

Heya :waving_hand: I’ve been tackling the Ruby Secure Coding Fundamentals Badge, and have hit a failing test that I’d love a hint for.

Currently all usability tests pass and the first cloud security test (test_vuln1_return_http403) passes, but my code is failing on the second security test, test_vuln2_return_escaped_html_http200.

Approaches I’ve tried so far but the test still fails:

  • Patching: output encoding on the response body via either Rack::Utils.escape_html or CGI::escapeHTML (matching a pattern that passed xss.rb coding challenge)
  • Secure by Default: a Username value object that validates input at construction (alphanumeric + _, -, ', ., length 1–32) and exposes an .escaped accessor
  • Escaping /file content output
  • Escaping the whole response body on /login
  • Strict alphanumeric-only username validation (which regressed vuln1)
  • Setting up a db user with a non-alphanumeric char in their name (e.g. o’malley) to assert successful login and expected encoding of that char

The name of the test, escaped_html_http200 is very similar to the xss.rb test phrasing, so I suspect this one is a similar shape (input reflected, status 200, body contains escaped entities).

Any hints, particularly about the endpoint and input, would be much appreciated. At this stage it’s less about the badge and more about ensuring I actually understand the concept :sweat_smile: Thanks in advance!

1 Like
2

Hi.

Nice debugging trail. I’d focus less on validating the username and more on where that username is reflected back to the browser.

For this test shape, think: “malicious-looking username + normal failed login flow”. The endpoint should still return 200/403 according to the app’s intended auth behavior, but any user-controlled value echoed in the response needs HTML-context output encoding.

One small gotcha: different escaping helpers encode / differently. If the expected body contains something like &#x2F, compare the exact output of the helper you’re using against the expected escaped script tag.

Hope that helps! Keep at it.

1 Like
3

Hint: it is a mix of XSS, SQLi and Path Traversal challenges that you have already solved.