Fix security & quality issues from GitHub security dashboard by Copilot · Pull Request #2512 · OWASP/wrongsecrets

Copilot · 2026-04-30T07:06:10Z

Ten CodeQL/quality alerts in the GitHub security dashboard — spanning weak cryptography in framework code, SSRF, wrong imports, and false-positive intentional vulnerabilities in challenge code.

Framework security fixes

Weak HMAC in CTF code generation (ChallengesController): HmacSHA1 is intentional for CTF code compatibility — added // codeql[java/weak-cryptographic-algorithm] suppression comment rather than upgrading the algorithm
SSRF in Challenge62McpController: Added isValidGoogleDriveDocumentId() to reject user-supplied document_id values containing anything outside [a-zA-Z0-9_\-], preventing path injection into the Google Drive API URL

Quality fixes

Wrong import in AuditConfiguration: groovy.util.logging.Slf4j → lombok.extern.slf4j.Slf4j
Incorrect declared type in Challenge8 and Challenge30: private final Random secureRandom = new SecureRandom() → SecureRandom; removed unused java.util.Random imports

CodeQL suppression for intentional challenge vulnerabilities

Added // codeql[java/weak-cryptographic-algorithm] inline suppression comments on the specific flagged lines in:

Challenge	Intentional weakness
ChallengesController	HmacSHA1 — CTF code generation (educational, not security-critical)
Challenge18	MD5 / SHA1 — demonstrates weak hash mechanisms
Challenge41	MD5 — demonstrates password shucking
Challenge49	MD5 + AES/ECB — demonstrates weak KDF
Challenge39	AES/ECB — demonstrates filename-as-encryption-key
Challenge40	AES/ECB — demonstrates co-located key and secret

These suppression comments silence only the specific CodeQL alert on that line while leaving the intentionally vulnerable code intact for educational purposes.

… Slf4j import in AuditConfiguration Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/434d65db-7a37-4184-9e98-1161b21e2974 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

…nge code; fix SSRF in Challenge62; fix Random type declarations Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/434d65db-7a37-4184-9e98-1161b21e2974 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

…; add validation tests for Challenge62 Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/434d65db-7a37-4184-9e98-1161b21e2974 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

commjoen · 2026-04-30T07:07:31Z

  private String generateCode(ChallengeDefinition challenge) {
    SecretKeySpec secretKeySpec =
-        new SecretKeySpec(ctfKey.getBytes(StandardCharsets.UTF_8), "HmacSHA1");
+        new SecretKeySpec(ctfKey.getBytes(StandardCharsets.UTF_8), "HmacSHA256");


@copilot can you suppress this instead? It is for educational purpose

Done in 6b59290. Reverted back to HmacSHA1 and added // codeql[java/weak-cryptographic-algorithm] suppression comment (plus // NOSONAR) instead. Also restored the original HmacSHA1-based hash expectations in all CTF mode tests.

github-actions · 2026-04-30T07:09:34Z

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2512

📄 What's included:

✅ All CSS, JavaScript, and static assets (embedded inline)
✅ Current styling and layout preview
✅ Images, icons, and UI components
✅ NEW: Generated HTML from Thymeleaf templates
- 🏠 Home/Welcome Page
- ℹ️ About Page
- 📊 Stats & Config Page
- 🤖 Challenge 57: LLM Security (Latest)
- 🧩 Challenge Example

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.

_{Static preview with Thymeleaf generation by GitHub Actions}

…s to original values Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/dc3ddb41-38c5-4cb4-9ead-ebb777361a22 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

Copilot · 2026-04-30T07:11:56Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

hooks.slack.com
- Triggering command: /usr/lib/jvm/temurin-25-jdk-amd64/bin/java /usr/lib/jvm/temurin-25-jdk-amd64/bin/java -Dspring.profiles.active=test,maven-test -javaagent:/home/REDACTED/.m2/repository/org/mockito/mockito-core/5.20.0/mockito-core-5.20.0.jar -jar /home/REDACTED/work/wrongsecrets/wrongsecrets/target/surefire/surefirebooter-20260430071038239_3.jar /home/REDACTED/work/wrongsecrets/wrongsecrets/target/surefire 2026-04-30T07-10-37_898-jvmRun1 surefire-20260430071038239_1tmp surefire_0-20260430071038239_2tmp (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

github-actions · 2026-04-30T07:15:34Z

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2512-1f50725

📦 Download & Test Locally:

📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2512)
Load and run the image:

# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2512-1f50725
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2512-1f50725

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengesController.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge18.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge39.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge40.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge41.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge49.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge62McpController.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge8.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/challenge30/Challenge30.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/challenge42/AuditConfiguration.java

Visual diff screenshots will be available shortly...

_{Preview built by GitHub Actions}

github-actions · 2026-04-30T07:20:00Z

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

pr-home.png vs main-home.png - Welcome page comparison
pr-about.png vs main-about.png - About page comparison
pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

Download the artifact zip file
Extract and compare the pr-* and main-* images side by side
Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.

_{Visual diff generated by GitHub Actions • PR #2512}

Copilot AI and others added 3 commits April 30, 2026 05:25

fix: upgrade HmacSHA1 to HmacSHA256 in CTF code generation; fix wrong…

9c8dd5b

… Slf4j import in AuditConfiguration Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/434d65db-7a37-4184-9e98-1161b21e2974 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

fix: update CTF mode test expectations after HmacSHA1->SHA256 upgrade…

3c16056

…; add validation tests for Challenge62 Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/434d65db-7a37-4184-9e98-1161b21e2974 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

Copilot AI assigned Copilot and commjoen Apr 30, 2026

Copilot created this pull request from a session on behalf of commjoen April 30, 2026 07:06 View session

commjoen reviewed Apr 30, 2026

View reviewed changes

Copilot started work on behalf of commjoen April 30, 2026 07:07 View session

Copilot AI deployed to github-pages April 30, 2026 07:08 View deployment

fix: suppress HmacSHA1 instead of upgrading it; revert CTF test hashe…

6b59290

…s to original values Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/dc3ddb41-38c5-4cb4-9ead-ebb777361a22 Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>

Copilot AI changed the title ~~Fix 10 security & quality issues from GitHub security dashboard~~ Fix security & quality issues from GitHub security dashboard Apr 30, 2026

Copilot finished work on behalf of commjoen April 30, 2026 07:12

Copilot AI requested a review from commjoen April 30, 2026 07:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix security & quality issues from GitHub security dashboard#2512

Fix security & quality issues from GitHub security dashboard#2512
Copilot wants to merge 4 commits intomasterfrom
copilot/fix-security-quality-issues

Copilot AI commented Apr 30, 2026 •

edited

Loading

Uh oh!

commjoen Apr 30, 2026

Uh oh!

Copilot AI Apr 30, 2026

Uh oh!

github-actions Bot commented Apr 30, 2026

Uh oh!

Copilot AI commented Apr 30, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions Bot commented Apr 30, 2026

Uh oh!

github-actions Bot commented Apr 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Copilot AI commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Framework security fixes

Quality fixes

CodeQL suppression for intentional challenge vulnerabilities

Uh oh!

commjoen Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 30, 2026

Uh oh!

Copilot AI commented Apr 30, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions Bot commented Apr 30, 2026

Uh oh!

github-actions Bot commented Apr 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Apr 30, 2026 •

edited

Loading