[🐛] Challenge progress restore triggers XSS on Score Board

🐛 Bug report

Description

1. Start local instance and go to /#/score-board
2. Notice that the copy-pastable XSS payloads (e.g. in DOM XSS or Bonus Payload challenge) are properly encoded
3. Confirm via /api/Challenges that those payloads are wrapped into <code>…</code> properly
4. Restore challenge progress from a local backup (works best with a continue code w/ lot of challenges solved)
5. Visit /#/score-board to notice that one or more XSS payloads now trigger
6. Check via /api/Challenges that the <code>…</code> enclosure is now missing in the API response

Additional Information

Could also be reproduced on https://preview.owasp-juice.shop/#/score-board and https://preview.owasp-juice.shop/api/Challenges

[bkimminich]

I guess the issue was reference semantics which saved the sanitized challenge description back into the cache upon the first notification and then finding it there for any subsequent notification (i.e. local restore) and then putting it into the DB.

Pretty wild that this was not noticed for 5 years… 😬

[github-actions[bot]]

This thread has been automatically locked because it has not had recent activity after it was closed. 🔒 Please open a new issue for regressions or related bugs.