Outputs of ctfconfig functions should be validated
Closed this issue · 1 comments
During ECSC, we learned that forgetting to run the extra value in get_targets() though json.dumps while trying to hot-patch things ends pretty badly... If the return value types were at least validated somehow, over half an hour of debugging and ataka downtime could have been avoided.
From what I remember, this caused ataka to stop updating flag IDs and provide old data to exploits - we couldn't figure out why for a long time. Later, when we restarted the server, everything stopped working altogether with database errors until we traced it down to the mistake in ctfconfig.
CC @szymex73
There is return type validation for the ctfconfig and a (mostly complete) self test on startup now, see cb29d4c
Won't catch everything, but improved the situation a lot