Track expected preceding interaction with URLs

(before a challenge is solved, and print percentage in cheat logs. Just informative for testing, no impact on score yet!)

Author: bkimminich

lib/antiCheat.ts

@@ -10,6 +10,8 @@ import { readFixes } from '../routes/vulnCodeFixes'
 import { type Challenge } from '../data/types'
 import { getCodeChallenges } from './codingChallenges'
 import logger from './logger'
+import { type NextFunction, type Request, type Response } from 'express'
+import * as utils from './utils'
 const median = require('median')
 
 const coupledChallenges = { // TODO prevent also near-identical challenges (e.g. all null byte file access or dom xss + bonus payload etc.) from counting as cheating
@@ -23,6 +25,25 @@ const trivialChallenges = ['errorHandlingChallenge', 'privacyPolicyChallenge', '
 
 const solves: Array<{ challenge: any, phase: string, timestamp: Date, cheatScore: number }> = [{ challenge: {}, phase: 'server start', timestamp: new Date(), cheatScore: 0 }] // seed with server start timestamp
 
+const preSolveInteractions: Array<{ challengeKey: any, urlFragments: string[], interactions: number }> = [
+  {
+    challengeKey: 'missingEncodingChallenge',
+    urlFragments: ['/assets/public/images/uploads/%F0%9F%98%BC-'],
+    interactions: 0
+  }
+]
+
+exports.checkForPreSolveInteractions = () => ({ url }: Request, res: Response, next: NextFunction) => {
+  preSolveInteractions.forEach((preSolveInteraction) => {
+    preSolveInteraction.urlFragments.forEach((urlFragment) => {
+      if (utils.endsWith(url, urlFragment)) {
+        preSolveInteraction.interactions++
+      }
+    })
+  })
+  next()
+}
+
 export const calculateCheatScore = (challenge: Challenge) => {
   const timestamp = new Date()
   let cheatScore = 0
@@ -37,7 +58,14 @@ export const calculateCheatScore = (challenge: Challenge) => {
   const minutesSincePreviousSolve = (timestamp.getTime() - previous().timestamp.getTime()) / 60000
   cheatScore += Math.max(0, 1 - (minutesSincePreviousSolve / minutesExpectedToSolve))
 
-  logger.info(`Cheat score for ${areCoupled(challenge, previous().challenge) ? 'coupled ' : (isTrivial(challenge) ? 'trivial ' : '')}${challenge.tutorialOrder ? 'tutorial ' : ''}${colors.cyan(challenge.key)} solved in ${Math.round(minutesSincePreviousSolve)}min (expected ~${minutesExpectedToSolve}min) with${config.get('challenges.showHints') ? '' : 'out'} hints allowed: ${cheatScore < 0.33 ? colors.green(cheatScore.toString()) : (cheatScore < 0.66 ? colors.yellow(cheatScore.toString()) : colors.red(cheatScore.toString()))}`)
+  const preSolveInteraction = preSolveInteractions.find((preSolveInteraction) => preSolveInteraction.challengeKey === challenge.key)
+  let percentPrecedingInteraction = -1
+  if (preSolveInteraction) {
+    percentPrecedingInteraction = preSolveInteraction.interactions / (preSolveInteraction.urlFragments.length * challenge.difficulty)
+    // TODO Add impact on actual cheat score
+  }
+
+  logger.info(`Cheat score for ${areCoupled(challenge, previous().challenge) ? 'coupled ' : (isTrivial(challenge) ? 'trivial ' : '')}${challenge.tutorialOrder ? 'tutorial ' : ''}${colors.cyan(challenge.key)} solved in ${Math.round(minutesSincePreviousSolve)}min (expected ~${minutesExpectedToSolve}min) with${config.get('challenges.showHints') ? '' : 'out'} hints allowed${ percentPrecedingInteraction > -1 ? (' and ' + percentPrecedingInteraction * 100 + '% expected preceding URL interaction') : ''}: ${cheatScore < 0.33 ? colors.green(cheatScore.toString()) : (cheatScore < 0.66 ? colors.yellow(cheatScore.toString()) : colors.red(cheatScore.toString()))}`)
   solves.push({ challenge, phase: 'hack it', timestamp, cheatScore })
   return cheatScore
 }

server.ts

@@ -118,6 +118,7 @@ const memory = require('./routes/memory')
 const chatbot = require('./routes/chatbot')
 const locales = require('./data/static/locales.json')
 const i18n = require('i18n')
+const antiCheat = require('./lib/antiCheat')
 
 const appName = config.get('application.customMetricsPrefix')
 const startupGauge = new client.Gauge({
@@ -205,6 +206,9 @@ restoreOverwrittenFilesWithOriginals().then(() => {
   /* robots.txt */
   app.use(robots({ UserAgent: '*', Disallow: '/ftp' }))
 
+  /* Check for any URLs having been called that would be expected for challenge solving without cheating */
+  app.use(antiCheat.checkForPreSolveInteractions())
+
   /* Checks for challenges solved by retrieving a file implicitly or explicitly */
   app.use('/assets/public/images/padding', verify.accessControlChallenges())
   app.use('/assets/public/images/products', verify.accessControlChallenges())