Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IDOR Unit Test Failing #313

Open
nvisium-john-poulin opened this issue Feb 21, 2018 · 1 comment
Open

IDOR Unit Test Failing #313

nvisium-john-poulin opened this issue Feb 21, 2018 · 1 comment
Labels

Comments

@nvisium-john-poulin
Copy link
Contributor

On the latest commit (67e1365) the IDOR unit test is failing on "attack two". I haven't checked other commits yet. The following behavior is that same whether or not the user has mitigated the vulnerability.

2) insecure direct object reference attack two
Tutorial: https://github.com/OWASP/railsgoat/wiki/A4-Insecure-Direct-Object-Reference
     Failure/Error: expect(first("td").text).not_to include(another_user.name)

     NoMethodError:
       undefined method `text' for nil:NilClass

One important thing to note is that another_user.name isn't even a valid method. I suspect it should be another_user.full_name

nvisium-john-poulin added a commit to nvisium-john-poulin/railsgoat that referenced this issue Feb 21, 2018
nvisium-john-poulin added a commit to nvisium-john-poulin/railsgoat that referenced this issue Feb 21, 2018
@gopye
Copy link

gopye commented Oct 1, 2019

I can confirm that these PRs got the specs failing in the correct manner

nvisium-john-poulin@991ea4c

nvisium-john-poulin@e710407

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants