Add Challenge 58: Database Connection String Exposure #2123
Conversation
…rror Messages Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>
Copilot
AI
changed the title
|
@copilot some workflows fail, can you adjust the code accordingly please? |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge57Controller.java
Fixed
Show fixed
Hide fixed
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-2497023
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-2497023Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-2497023
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-2497023Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2123 |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2123 |
Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>
src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge57Controller.java
Fixed
Show fixed
Hide fixed
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-84e9448
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-84e9448Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2123 |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview generated by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-ec4e504
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-ec4e504Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2123 |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-3c1e226
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-3c1e226Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-939bc5f
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-939bc5fThen visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2123 |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2123 |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-8e96e74
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-8e96e74Then visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2123 |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-e7c9f8c
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-e7c9f8cThen visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2123 |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-8b2168e
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-8b2168eThen visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2123 |
|
🌐 GitHub Pages Preview Ready! Your static preview is now available at: 📄 What's included:
For full functionality testing: Use the Docker preview instead. 🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR. Static preview with Thymeleaf generation by GitHub Actions |
|
🔨 Preview Build Complete! Your changes have been built and pushed to GitHub Container Registry. 🐳 Docker Image: 📦 Download & Test Locally:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview🚀 Alternative - Pull from Registry: docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-349a70a
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2123-349a70aThen visit: http://localhost:8080 📝 Changes in this PR: Visual diff screenshots will be available shortly... Preview built by GitHub Actions |
|
📸 Visual Diff Ready! Screenshots comparing your changes with the main branch are available: 📁 Download Visual Diff Artifacts 🖼️ Included screenshots:
🔍 How to review:
💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily. Visual diff generated by GitHub Actions • PR #2123 |
|
🧹 Preview Cleanup Complete The static preview for this PR has been removed from GitHub Pages. Thanks for contributing to WrongSecrets! 🎉 Cleanup completed by GitHub Actions |
This PR implements Challenge 58, demonstrating a critical real-world vulnerability: database connection strings with embedded credentials exposed through poor error handling.
Challenge 58: Database Connection String Exposure
Category: Logging
Difficulty: Normal (⭐⭐⭐)
Target Secret:
SuperSecretDB2024!The challenge simulates a PostgreSQL connection failure that exposes the full connection string with embedded credentials through both HTTP error responses and application logs. Users access the vulnerable endpoint
/error-demo/database-connectionto trigger the error scenario.Educational Value
This challenge addresses one of the most common and dangerous ways secrets leak in production applications:
Implementation Details
This implementation follows existing project patterns and maintains the educational focus on helping developers recognize and prevent database credential exposure through error messages.
Technical Changes
The challenge demonstrates realistic error scenarios that developers encounter in production, making it highly valuable for security awareness training.
💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.