[🐛] A possible bug when solving the challenge "Expired Coupon"

🐛 Bug report

Description

Hello! I`ve found a bug when solving the “Expired Coupon” in another way.

I found a way to bypass the date validation by using breakpoint and editing the “this.clientdate” in the console.

The discount worked, but the challenge didn`t solved.

Is this a regression?

IDK…

🔬 Minimal Reproduction

I use the Juice Shop in Simplified Chinese, but I think these pictures would contain necessary infomation.

🔥 Exception or Error

No.

🌳 Your Environment

Docker

Additional Information

Windows10, Firefox85.0.2, OWASP ZAP

[bkimminich]

Ah ok, if the coupon wasn’t really accepted, then it makes sense you didn’t see the confirmation. In our step by step solution we recommend to change the system time, and our end to end test https://www.github.com/bkimminich/juice-shop/tree/master/test%2Fe2e%2FbasketSpec.js overloads the new Date() call to give back the campaign date.

[TracingDrone]

@TokinoLynx 请问可以确认一下订单最后实际付款后真的打折了吗?我试验发现仅仅在图中那行断点后修改clientDate值,虽然UI中显示成功获得折扣,但SessionStorage里的clientDate仍然是当前时间,所以我最后付款时仍然没有折扣,所以此项任务未完成. 而如果我再修改一下Storage里的时间,任务就通过了.

我今天早上测试了一下。也许你说对了，如果只修改this.ClientDate的话，接下来确认订单会显示折扣，但下单成功的页面则是原价。

I tested this morning. Maybe you’re right, if I modify this.ClientDate only, the discount show up normally in the order confirmation page, but the discount don’t apply after I submit the order.

如果修改系统时间的话，下单后才会显示正常的折扣。

The discount apply successfully only if I change the system time.

我还没测试sessionStorage的修改。如果修改完Session Storage才能完成任务的话，那应该不是Bug，而是我不够细心。

I haven’t test the modification of sessionStorage, if the challenge can be solved by editing sessionStorage, it would prove that my careless lead to the"bug".

@chinggg