Skip to content

Add Challenge61: Telegram Channel Secrets with Real API Integration#2206

Merged
commjoen merged 22 commits intomasterfrom
copilot/fix-2130
Mar 6, 2026
Merged

Add Challenge61: Telegram Channel Secrets with Real API Integration#2206
commjoen merged 22 commits intomasterfrom
copilot/fix-2130

Conversation

Copy link
Contributor

Copilot AI commented Aug 30, 2025

  • Analyze current state of Challenge60 files
  • Rename Challenge60.java to Challenge61.java (update class name and logger)
  • Rename Challenge60Test.java to Challenge61Test.java (update class references)
  • Rename challenge60.adoc to challenge61.adoc
  • Rename challenge60_hint.adoc to challenge61_hint.adoc (update class reference inside)
  • Rename challenge60_reason.adoc to challenge61_reason.adoc
  • Update wrong-secrets-configuration.yaml to reference challenge61
  • Fix compilation error: replace removed RestTemplateBuilder with SimpleClientHttpRequestFactory (Spring Boot 4.x removed org.springframework.boot.web.client.RestTemplateBuilder)

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI and others added 2 commits August 30, 2025 04:21
Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>
Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>
Copilot AI changed the title [WIP] Telegram channel challenge Add Challenge59: Telegram Channel Secrets - Hardcoded Bot Credentials Vulnerability Aug 30, 2025
Copilot AI requested a review from commjoen August 30, 2025 04:31
@commjoen
Copy link
Collaborator

@copilot we use Java 23 . Please make everything java23 again

@github-actions
Copy link

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2206

📄 What's included:

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.


Static preview with Thymeleaf generation by GitHub Actions

@github-actions
Copy link

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2206

📄 What's included:

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.


Static preview with Thymeleaf generation by GitHub Actions

Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Aug 30, 2025

@copilot we use Java 23 . Please make everything java23 again

Restored Java version to 23 in pom.xml as requested. The change reverts the java.version property from 17 back to 23 (commit 938b181). The maven.compiler.target was already set to 23 and remains unchanged.

@github-actions
Copy link

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-e0ebf11

📦 Download & Test Locally:

  1. 📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2206)
  2. Load and run the image:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-e0ebf11
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-e0ebf11

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/Challenges.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengeUI.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengesController.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge59.java
- src/main/resources/explanations/challenge59.adoc
- src/main/resources/explanations/challenge59_hint.adoc
- src/main/resources/explanations/challenge59_reason.adoc

Visual diff screenshots will be available shortly...


Preview built by GitHub Actions

@github-actions
Copy link

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-e0ebf11

📦 Download & Test Locally:

  1. 📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2206)
  2. Load and run the image:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-e0ebf11
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-e0ebf11

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/Challenges.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengeUI.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengesController.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge59.java
- src/main/resources/explanations/challenge59.adoc
- src/main/resources/explanations/challenge59_hint.adoc
- src/main/resources/explanations/challenge59_reason.adoc

Visual diff screenshots will be available shortly...


Preview built by GitHub Actions

@github-actions
Copy link

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

  • pr-home.png vs main-home.png - Welcome page comparison
  • pr-about.png vs main-about.png - About page comparison
  • pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

  1. Download the artifact zip file
  2. Extract and compare the pr-* and main-* images side by side
  3. Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.


Visual diff generated by GitHub Actions • PR #2206

@github-actions
Copy link

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

  • pr-home.png vs main-home.png - Welcome page comparison
  • pr-about.png vs main-about.png - About page comparison
  • pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

  1. Download the artifact zip file
  2. Extract and compare the pr-* and main-* images side by side
  3. Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.


Visual diff generated by GitHub Actions • PR #2206

@github-actions
Copy link

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2206

📄 What's included:

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.


Static preview with Thymeleaf generation by GitHub Actions

@commjoen
Copy link
Collaborator

@copilot please use java23 syntax including getfirst and getlast

@github-actions
Copy link

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-94b4292

📦 Download & Test Locally:

  1. 📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2206)
  2. Load and run the image:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-94b4292
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-94b4292

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/Challenges.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengeUI.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengesController.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge59.java
- src/main/resources/explanations/challenge59.adoc
- src/main/resources/explanations/challenge59_hint.adoc
- src/main/resources/explanations/challenge59_reason.adoc

Visual diff screenshots will be available shortly...


Preview built by GitHub Actions

@github-actions
Copy link

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-94b4292

📦 Download & Test Locally:

  1. 📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2206)
  2. Load and run the image:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-94b4292
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-94b4292

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/Challenges.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengeUI.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengesController.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge59.java
- src/main/resources/explanations/challenge59.adoc
- src/main/resources/explanations/challenge59_hint.adoc
- src/main/resources/explanations/challenge59_reason.adoc

Visual diff screenshots will be available shortly...


Preview built by GitHub Actions

@github-actions
Copy link

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

  • pr-home.png vs main-home.png - Welcome page comparison
  • pr-about.png vs main-about.png - About page comparison
  • pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

  1. Download the artifact zip file
  2. Extract and compare the pr-* and main-* images side by side
  3. Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.


Visual diff generated by GitHub Actions • PR #2206

@github-actions
Copy link

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2206

📄 What's included:

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.


Static preview with Thymeleaf generation by GitHub Actions

@github-actions
Copy link

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-c323d1d

📦 Download & Test Locally:

  1. 📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2206)
  2. Load and run the image:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-c323d1d
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-c323d1d

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge14.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge60.java
- src/main/resources/explanations/challenge60.adoc
- src/main/resources/explanations/challenge60_hint.adoc
- src/main/resources/explanations/challenge60_reason.adoc

Visual diff screenshots will be available shortly...


Preview built by GitHub Actions

@github-actions
Copy link

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

  • pr-home.png vs main-home.png - Welcome page comparison
  • pr-about.png vs main-about.png - About page comparison
  • pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

  1. Download the artifact zip file
  2. Extract and compare the pr-* and main-* images side by side
  3. Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.


Visual diff generated by GitHub Actions • PR #2206

@commjoen
Copy link
Collaborator

commjoen commented Mar 6, 2026

@copilot Another MR became challenge60, this means that we have to update all the new contents in this MR to become challenge61. Can you update all the code here to be challenge61 instead?

Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Mar 6, 2026

@copilot Another MR became challenge60, this means that we have to update all the new contents in this MR to become challenge61. Can you update all the code here to be challenge61 instead?

Updated all content from Challenge60 to Challenge61 in commit e2d78fb:

  • Challenge60.javaChallenge61.java (class name, logger, constructors)
  • Challenge60Test.javaChallenge61Test.java (all class references)
  • challenge60*.adocchallenge61*.adoc (including hint file reference update)
  • wrong-secrets-configuration.yaml updated to reference Challenge61 and challenge-61

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • checkstyle.org
    • Triggering command: /opt/hostedtoolcache/CodeQL/2.24.2/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.24.2/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.24.2/x64/codeql/xml/tools/xml-extractor.jar --fileList=/tmp/codeql-scratch-54b93b06a133b0d9/dbs/java/working/files-to-index5491394632681817234.list --sourceArchiveDir=/tmp/codeql-scratch-54b93b06a133b0d9/dbs/java/src --outputDir=/tmp/codeql-scratch-54b93b06a133b0d9/dbs/java/trap/java (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI changed the title Add Challenge60: Telegram Channel Secrets with Real API Integration Add Challenge61: Telegram Channel Secrets with Real API Integration Mar 6, 2026
@commjoen
Copy link
Collaborator

commjoen commented Mar 6, 2026

@copilot can you fix the failing github actions please?

…Spring Boot 4) with SimpleClientHttpRequestFactory

Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Mar 6, 2026

@copilot can you fix the failing github actions please?

Fixed in commit 7ada768. The build failure was caused by RestTemplateBuilder being removed in Spring Boot 4.x (package org.springframework.boot.web.client does not exist). Replaced it with SimpleClientHttpRequestFactory using Duration-based timeouts, matching the pattern in WrongSecretsApplication.java.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • checkstyle.org
    • Triggering command: /opt/hostedtoolcache/CodeQL/2.24.2/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.24.2/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.24.2/x64/codeql/xml/tools/xml-extractor.jar --fileList=/tmp/codeql-scratch-54b93b06a133b0d9/dbs/java/working/files-to-index15196729679738833227.list --sourceArchiveDir=/tmp/codeql-scratch-54b93b06a133b0d9/dbs/java/src --outputDir=/tmp/codeql-scratch-54b93b06a133b0d9/dbs/java/trap/java (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

@github-actions
Copy link

github-actions bot commented Mar 6, 2026

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2206

📄 What's included:

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.


Static preview with Thymeleaf generation by GitHub Actions

@github-actions
Copy link

github-actions bot commented Mar 6, 2026

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-ec6c9b2

📦 Download & Test Locally:

  1. 📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2206)
  2. Load and run the image:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-ec6c9b2
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2206-ec6c9b2

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge14.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge61.java
- src/main/resources/explanations/challenge61.adoc
- src/main/resources/explanations/challenge61_hint.adoc
- src/main/resources/explanations/challenge61_reason.adoc

Visual diff screenshots will be available shortly...


Preview built by GitHub Actions

@github-actions
Copy link

github-actions bot commented Mar 6, 2026

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

  • pr-home.png vs main-home.png - Welcome page comparison
  • pr-about.png vs main-about.png - About page comparison
  • pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

  1. Download the artifact zip file
  2. Extract and compare the pr-* and main-* images side by side
  3. Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.


Visual diff generated by GitHub Actions • PR #2206

@commjoen commjoen marked this pull request as ready for review March 6, 2026 11:00
@commjoen commjoen merged commit 58c3c73 into master Mar 6, 2026
20 checks passed
@commjoen commjoen deleted the copilot/fix-2130 branch March 6, 2026 11:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants