Release Notes v10.1.0

[Bjoern Kimminich]

v10.1.0

This release brings significant changes to existing challenges (⚡️) which might break canned CTF setups as well as solution guides made for previous versions of OWASP Juice Shop!

🎯 Challenges

• #1245: (⚡️) Refactored Classic Stored XSS (⭐️⭐️) challenge into CSP Bypass (⭐️⭐️⭐️⭐️) challenge (kudos to @Scar26)
• #1325: Added Deluxe Fraud challenge (⭐️⭐️⭐️) where a Deluxe Membership must be obtained surreptitiously (kudos to @Scar26)
• #902: Added CSRF challenge (⭐️⭐️⭐️) where a username change must be triggered via an online HTML editor (kudos to @dnull)
• Added Bonus Payload challenge (⭐️) which (by default) makes you listen to the OWASP Juice Shop Jingle
• Doubled the length of data leaked during XXE Data Access attacks before truncating
• #1295: (⚡️) The Forged JWT challenge is now always disabled on Windows - see #1310 (comment)

🤖 Hacking Instructor

• #1331: Any tutorial can now be launched via direct link to
  • /#/hacking-instructor?challenge=<challenge name> (kudos to @Scar26)
  • e.g. http://demo.owasp-juice.shop/#/hacking-instructor?challenge=Score%20Board
• Added waitForDevTools() helper function for Score Board, View Basket and Forged Feedback tutorials

🎭 Customization

• Added challenges.xssBonusPayload property to define a custom payload for the Bonus Payload challenge

🚔 Start-up validations

• An inventory of at least 4 products is now explicitly expected (instead of implicitly via unique/unambiguous special products checks)

📟 Operations

• #1353: Replaced all absolute with relative links to allow serving Juice Shop from a sub directory (kudos to @JamesCullum)
  • When running in a sub directory its name must be passed in via the BASE_PATH environment variable

⚙️ DevOps Automation

• Added Automatic Rebase action triggering on /rebase comments in PRs
• #1355: Added workflow for automatic update of challenges.yml in https://github.com/OWASP/www-project-juice-shop
• Added workflow to automatically add release notes to tab_news.md in https://github.com/OWASP/www-project-juice-shop

🐛 Fixes

• #1295: Repaired the JWT behavior so that the related challenges actually produce working tokens (kudos to @Scar26)
• #1343: Fixed Vagrant provisioning by switching to official Docker CE and APT repository (kudos to @adamczi)
• #1351: Fixed issues with customization of Photo Wall memories (kudos to @nickmurison)
• a082f62: Added missing id fields and populated from product.id in pre-defined orders
• XSS end-to-end tests are now less likely to fail from alerts showing up at the wrong time (kudos to @JamesCullum)

🌐 I18N

• Added translation strings for new or changed challenges