Notes

Accessibility information
This page has four areas: A sidebar with information about the challenge, a tree view “File Explorer” containing the project files, a “Code blocks” section with a list of code blocks relevant to the challenge, and a code viewer section. The code viewer section has two groups of toggle buttons at the top, to select and compare the vulnerable code with possible solutions. One group selects the code comparison base and the other selects a solution to submit as an answer. Below those are tabs displaying opened files, with the currently opened file presented in a table. The presentation of the code viewer table depends on the ‘inline diff view’ option under editor settings. If unchecked, the table has 5 columns: Code block indicator, two for line number and code of the selected comparison base, and two for the line number and code of the selected solution variation. If ‘inline diff’ is checked, the table has 4 columns: Code block indicator, line number for the code from the comparison base, line number for the code from the selected solution, and a column with the code itself. In both presentations the code block indicator is only present in the first line of a code block and only if ‘vulnerable code’ is the current comparison base. Each line of code within a code block is prefixed with ‘CBX’, where X is a number used to distinguish between code blocks. Deleted code lines are prefixed with a ‘-’ symbol, and added lines with a ‘+’ symbol. Opening category information, pressing the hints or submit buttons will open a modal dialog.

Skip to Code Editor
Identify the vulnerability
Fix the vulnerability
Fix the vulnerability
Find and select the solution that fixes the vulnerability listed below. Each solution may take a different approach to address the problem, but only one solution is correct.

Vulnerability Category
Access Control - Using input from untrusted sources

Actions
Attempts left: 1

View shortcuts keyboard hotkey:?

File Explorer
Highlighted files only: 30 files hidden


config
env
*development.js
controllers2 code blocks
*snippets.js1 code blocks
1
*users.js1 code blocks
1
Code blocks
snippets.js:38-54
users.js:42-45
Comparison baseComparison base
Selected solutionSelected solution
// config - local
// config - local


module.exports = {
module.exports = {
dbConnectionString: 'mongodb://localhost/nodejs-code-repository',
dbConnectionString: 'mongodb://localhost/nodejs-code-repository',
saltRounds: 10,
saltRounds: 10,
sessionConfig: {
sessionConfig: {
secret: 's3Cur3',
secret: 's3Cur3',
name: 'sessionId',
name: 'sessionId',
cookie: {
cookie: {
secure: 'true',
secure: 'true',
httpOnly: 'true'
httpOnly: 'true'
}
}
},
},
uploadDir: '/mnt/nodejs_code_repository/uploads'
uploadDir: '/mnt/nodejs_code_repository/uploads',
adminCookie: '21232f297a57a5a743894a0e4a801fc3'
};
};

below is 2nd option
Accessibility information
This page has four areas: A sidebar with information about the challenge, a tree view “File Explorer” containing the project files, a “Code blocks” section with a list of code blocks relevant to the challenge, and a code viewer section. The code viewer section has two groups of toggle buttons at the top, to select and compare the vulnerable code with possible solutions. One group selects the code comparison base and the other selects a solution to submit as an answer. Below those are tabs displaying opened files, with the currently opened file presented in a table. The presentation of the code viewer table depends on the ‘inline diff view’ option under editor settings. If unchecked, the table has 5 columns: Code block indicator, two for line number and code of the selected comparison base, and two for the line number and code of the selected solution variation. If ‘inline diff’ is checked, the table has 4 columns: Code block indicator, line number for the code from the comparison base, line number for the code from the selected solution, and a column with the code itself. In both presentations the code block indicator is only present in the first line of a code block and only if ‘vulnerable code’ is the current comparison base. Each line of code within a code block is prefixed with ‘CBX’, where X is a number used to distinguish between code blocks. Deleted code lines are prefixed with a ‘-’ symbol, and added lines with a ‘+’ symbol. Opening category information, pressing the hints or submit buttons will open a modal dialog.

Skip to Code Editor
Identify the vulnerability
Fix the vulnerability
Fix the vulnerability
Find and select the solution that fixes the vulnerability listed below. Each solution may take a different approach to address the problem, but only one solution is correct.

Vulnerability Category
Access Control - Using input from untrusted sources

Actions
Attempts left: 1

View shortcuts keyboard hotkey:?

File Explorer
Highlighted files only: 26 files hidden


controllers2 code blocks
*snippets.js1 code blocks
1
*users.js1 code blocks
1
public
app
js
services
*CodeSnippet.js
*Session.js
*app.js
*index.html
*bower.json
Code blocks
snippets.js:38-54
users.js:42-45
Comparison baseComparison base
Selected solutionSelected solution
// config - local

module.exports = {
dbConnectionString: 'mongodb://localhost/nodejs-code-repository',
saltRounds: 10,
sessionConfig: {
secret: 's3Cur3',
name: 'sessionId',
cookie: {
secure: 'true',
httpOnly: 'true'
}
},
uploadDir: '/mnt/nodejs_code_repository/uploads'
};


this is 3nd option

module.exports = {
dbConnectionString: 'mongodb://localhost/nodejs-code-repository',
saltRounds: 10,
sessionConfig: {
secret: 's3Cur3',
name: 'sessionId',
cookie: {
secure: 'true',
httpOnly: 'true'
}
},
uploadDir: '/mnt/nodejs_code_repository/uploads',
adminCookie: {
key: '21232f297a57a5a743894a0e4a801fc3',
value: 'b326b5062b2f0e69046810717534cb09'
}
};


below is 4 th option so could you please let me know which is the correct ans