Migrate labs json file to dedicated labs model#535
Conversation
| {"name": "xxe_lab", "build_location": "dockerized_labs/xxe_lab", "port": 5010}, | ||
| {"name": "dependency_attack_lab", "build_location": "dockerized_labs/dependency_attack_lab", "port": 5020}, | ||
| {"name": "package_injection_lab", "build_location": "dockerized_labs/package_injection_lab", "port": 5021}, | ||
| {"name": "open_source_library_attack_lab", "build_location": "dockerized_labs/open_source_library_attack_lab", "port": 5022} |
There was a problem hiding this comment.
This list will be updated in future, so user have to update previous migration, which is not recomanded
better solution is keep a seed script or seed command ready for populating this table. Then in future user have to update that seed script, not previous migration file
| const btn = document.createElement('button'); | ||
| btn.type = 'button'; | ||
| btn.className = 'sidebar-list-items lab-button'; | ||
| btn.setAttribute('onclick', `launchLab('${lab.name}')`); |
There was a problem hiding this comment.
lab.name comes from the create/update endpoint without validation, and this builds an inline JS handler. A name like x\x27);alert(1);// becomes executable code when the sidebar is rendered and clicked. Use addEventListener("click", () => launchLab(lab.name)) and validate names server-side against the slug format used by the URL.
| @@ -1,277 +0,0 @@ | |||
| import datetime | |||
There was a problem hiding this comment.
This deletion breaks URLConf import: introduction/urls.py still has from . import mitre, views. With this module removed, importing the URLConf raises ImportError/ModuleNotFoundError before any route is served. Please either keep the module or remove the import and all remaining /mitre/... references in the template/sidebar.
|
|
||
| try: | ||
| try: | ||
| lab = Lab.objects.get(id=lab_id) |
There was a problem hiding this comment.
This lookup is not scoped to custom labs, so any authenticated user who can guess or enumerate a built-in Lab id can POST to /challenge/custom-labs/update/<id>/ and overwrite its name, build_location, and port. The delete endpoint has the same issue. Please fetch with id=lab_id, is_custom=True and return 404/403 for built-ins, or restrict these endpoints to staff/admin.
3 participants
Migrate labs JSON config to Django database & enable Custom Labs CRUD
Overview
This PR migrates the static list of labs from
labs.jsonto a database-backed Django model Lab. This enables dynamic custom lab management (CRUD) directly from the user interface.Key Changes
startuplabsmanagement command to retrieve labs from the database, registered the model in Django Admin, and deleted the obsoletelabs.jsonfile.HEALTHCHECKdirective in the Dockerfile, removed obsolete MITRE endpoints/views, and updated the setup instructions in README.md.