Remove the dead frontend build chain, repair the CSRF PoC - #24
Merged
Conversation
Deletes the Vite/npm toolchain, which was never wired up:
resources/views/welcome.blade.php 72K, the Laravel default page with
Tailwind inlined. Unreachable -- no
route maps to it.
vite.config.js, package.json only needed by that page
resources/css/app.css only @Vite input
resources/js/app.js only @Vite input
welcome.blade.php was the ONLY file referencing @Vite, and nothing
referenced `welcome`. Their presence implied a build step this project
deliberately does not have: docs/api-refactor.md §10.2 argues for a
framework-free client precisely so the innerHTML sinks the XSS lessons
depend on stay visible instead of being hidden behind a bundler.
Also fixes a comment in AccountController that pointed at resources/js
for the render helper, which actually lives in layouts/app.blade.php.
Repairs payload/csrf/offer.html rather than deleting it -- it is exercise
material worth having. It posted `bacno` where the endpoint reads
`tacno`, so it never worked even against the legacy app: the request
arrived, was accepted, and moved nothing. Silent success, which is the
same failure shape as the lesson it is meant to demonstrate. It also
targeted a domain that is not the lab.
It now posts the right parameter to /api/v2/transfers with a
configurable TARGET, and documents why the attack works -- session
cookie auth, no VerifyCsrfToken on the api group, and form-encoded
acceptance, all three of which are required, since a JSON-only API is
not CSRF-able.
docs/legacy-mapping.md §7.5 updated from "needs repair" to resolved.
82 tests still pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removed: the Vite/npm toolchain
Never wired up.
welcome.blade.phpwas the only file referencing@vite, and nothing referencedwelcome— no route maps to it.resources/views/welcome.blade.phpvite.config.js,package.jsonresources/css/app.css,resources/js/app.js@viteinputsTheir presence implied a build step this project deliberately doesn't have.
docs/api-refactor.md§10.2 argues for a framework-free client precisely so theinnerHTMLsinks the XSS lessons depend on stay visible rather than hidden behind a bundler — leaving a half-configured Vite setup next to that reasoning was actively misleading.Also fixes a comment in
AccountControllerpointing atresources/jsfor the render helper, which lives inlayouts/app.blade.php.Repaired, not deleted:
payload/csrf/offer.htmlIt's exercise material worth keeping — but it was broken, and how it was broken is worth reading.
It posted a field named
bacno. The endpoint has always readtacno. So the request arrived, was accepted, and transferred nothing — silent success, which is the same failure shape as the lesson it's meant to demonstrate. It also pointed atkrishnarp.guru, which isn't the lab.Now posts the correct parameter to
/api/v2/transferswith a configurableTARGET, and documents why the attack works: session-cookie auth, noVerifyCsrfTokenon the api group, and form-encoded acceptance — all three required, since a JSON-only API isn't CSRF-able.docs/legacy-mapping.md§7.5 updated from "needs repair" to resolved.Deliberately kept
Worth stating so nobody removes them later thinking they're stale:
src/— the legacy flat-PHP app, preserved for before/after scanner comparison (legacy-mapping.md§8)dbscript/banktable.sql— the source the migration was derived fromDockerfile+dock/— build the legacy image, documented in the README82 tests still pass.
🤖 Generated with Claude Code