mirror of
https://github.com/KeygraphHQ/validation-benchmarks.git
synced 2026-11-07 10:56:03 -10:00
ajmalleshandClaude
14294b0003
Comprehensive hint removal to prevent vulnerability type disclosure while maintaining full build functionality and application behavior. Changes: - Deleted 48 metadata files (24 README.md, 24 benchmark.yaml) - Sanitized 24 benchmark.json files (removed name hints, descriptions, tags, levels) - Modified 150+ code files to remove vulnerability-revealing content - Renamed 15+ files/directories to remove vulnerability type references Metadata Changes: - Removed all descriptive challenge names (e.g., "Basic IDOR", "Cross 25", "PHP SSRF") - Replaced with generic format: "XBEN-XXX-24" - Removed all tags revealing vulnerability types (idor, xss, sqli, ssrf, ssti, lfi, etc.) - Removed difficulty level indicators - Kept required fields: canaries, win_condition Code Changes (XBEN-001-003): - Renamed idor_broken_authz_trading_platform → trading_platform_db - Renamed idor_indirect_trading_platform → trading_platform - Renamed idor_custom_authn_header_trading_platform → trading_platform - Removed 2 multi-line comments explaining IDOR vulnerabilities - Updated all database passwords, connection strings, and path references Code Changes (XBEN-004-018): - Renamed all XSS_CONTENT* variables → PAGE_CONTENT* or TEMPLATE_CONTENT* - Changed check_xss() → check_solution() or check_result() - Renamed /css/xss/ directories → /css/templates/ or /css/challenges/ - Renamed 21 CSS files: xss*.css → page*.css or template*.css - Removed X-XSS-Protection header hints - Changed is_admin → level (privilege escalation hint removal) - Removed difficulty level comments (EASY, MEDIUM, HARD) - Sanitized error messages to be less revealing Code Changes (XBEN-019-024): - Renamed lfi_static_resource → webapp - Renamed ssrf-demo-app → web-app - Renamed ssti_include_loan_calculator → loan_calculator - Renamed ssti_blind_loan_calculator → loan_calculator - Changed page titles: "SSRF Demo" → "Company Portal", "AUTH 04" → "Springfield Login" - Removed major vulnerability explanation comments (SSTI, LFI, SSRF) - Removed 44-line API documentation revealing hidden endpoints - Removed credential hints (TODO comments with test:test) Build Verification: - 21/24 benchmarks build successfully - 3 failures (XBEN-012, 013, 018) due to pre-existing Debian Buster EOL issue - All functional code preserved, only hints removed 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>