Skip to content

fix(views): correct container reuse logic, fix flag validation, subprocess errors, port range, cleanup#443

Open
suradadhanush wants to merge 2 commits into
adeyosemanputra:masterfrom
suradadhanush:fix/views-subprocess-container-reuse-flag-validation
Open

fix(views): correct container reuse logic, fix flag validation, subprocess errors, port range, cleanup#443
suradadhanush wants to merge 2 commits into
adeyosemanputra:masterfrom
suradadhanush:fix/views-subprocess-container-reuse-flag-validation

Conversation

@suradadhanush

Copy link
Copy Markdown

Changes

Container Reuse (resolves TODO in post())

The previous implementation called docker run unconditionally before checking if a container could be reused — causing orphaned containers on every reuse-eligible POST. Additionally, the reuse check compared a 12-char short ID from docker ps against the full 64-char container ID stored in the database, so reuse never triggered even when the container was healthy.

Fix: Attempt docker start directly first. docker start returns non-zero if the container doesn't exist — this is used as the fallback signal to create a new one. No docker ps check needed.

Flag Validation (resolves TODO in put())

Django does not parse PUT request bodies into request.POST. request.POST.get('flag') always returns None on a PUT request, causing the endpoint to always return 400.

Fix: Parse the request body directly using json.loads(request.body). SHA-256 hash comparison against the stored hashed_ prefixed flag is preserved correctly.

Subprocess error handling

Added stderr=subprocess.PIPE and returncode != 0 checks to all subprocess.Popen calls — previously silent failures returned 200 with a garbage container_id.

Other fixes

  • Port scan starts at 8001 instead of 8000 — app runs on 8000, scanning from 8000 wastes a check every time
  • Removed unused import csrf_exempt (Flake8 F401)
  • Fixed typo: challangechallenge in put() method parameter

…errors, port range, cleanup

- Reorder post() to attempt docker start before any docker run — prevents orphaned containers
- Remove broken docker ps short ID vs full ID comparison — use direct restart returncode instead
- Fix flag validation: replace request.POST.get with json.loads(request.body) for PUT requests
- Add stderr=subprocess.PIPE and returncode checks to all subprocess calls
- Start port scan from 8001 to avoid collision with app on 8000
- Remove unused import csrf_exempt (Flake8 F401)
- Fix typo: 'challange' -> 'challenge' in put() parameter
- ChallengeModelTest: validates flag hashing and port range enforcement
- FlagValidationTest: 5 cases covering correct/wrong/empty/unauth/invalid-JSON
- ContainerReuseTest: mocks subprocess to verify docker start before docker run

docs: add docs/API_DOCUMENTATION.md for challenge system endpoints
feat(settings): add security headers (XSS, HSTS, X-Frame-Options, NOSNIFF)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant