Add annotation

commjoen · commjoen · commit f8fda2d88166 · 2025-07-09T09:13:30.000+02:00
diff --git a/cursor/rules/conversation-log.txt b/cursor/rules/conversation-log.txt
@@ -33,3 +33,12 @@ Assistant: Added a step-by-step guide for fast challenge creation to project-spe
 
 User: can you store our conversation next to it in cursor/rules as a text file?
 Assistant: (this file)
+
+User: challenge56 seems to have a path traversal issue, can you annotate or fix it?
+Assistant: Added comments and a runtime check to restrict file access to the cursor/rules directory, and annotated the code with warnings about path traversal risk.
+
+User: can you add SuppressFBWarnings to getActualSecret ?
+Assistant: Added @SuppressFBWarnings annotation to getActualSecret with justification for educational context.
+
+User: can you update the conversation history file?
+Assistant: (this file)
diff --git a/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge56.java b/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge56.java
@@ -3,6 +3,7 @@
 import static org.owasp.wrongsecrets.Challenges.ErrorResponses.FILE_MOUNT_ERROR;
 
 import com.google.common.base.Strings;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -36,6 +37,9 @@ public boolean answerCorrect(String answer) {
     return !Strings.isNullOrEmpty(answer) && getActualSecret().equals(answer.trim());
   }
 
+  @SuppressFBWarnings(
+      value = "PATH_TRAVERSAL_IN",
+      justification = "Intentional for educational purposes in this challenge; see documentation.")
   private String getActualSecret() {
     if (Strings.isNullOrEmpty(actualSecret)) {
       try {
