From 4fac6ed86d8cf2b12dcde314b77195fee1a55a34 Mon Sep 17 00:00:00 2001 From: cato447 Date: Tue, 20 Oct 2026 20:33:23 +0200 Subject: [PATCH] do not leak flags --- tracker/checks.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tracker/checks.py b/tracker/checks.py index 3d65b31..a1556e5 100644 --- a/tracker/checks.py +++ b/tracker/checks.py @@ -156,7 +156,8 @@ def flag_is_valid(c: Challenge, d: Description) -> list[str]: b = [] content = str(d.flag.get("content") or "") if not FLAG_RE.match(content): - b.append(f"flag {content} is not h4tum{{...}}" if content else "no flag in description.yml") + # never print the content: a wrong prefix or stray whitespace still leaves a real flag + b.append("flag in description.yml is not h4tum{...}" if content else "no flag in description.yml") if d.flag.get("dynamic") and not any(isinstance(x.get("flag"), dict) for x in d.containers): b.append("dynamic flag, but no container is handed one") return b