do not leak flags

2026-10-20 20:33:23 +02:00
parent f62c95570e
commit 4fac6ed86d
1 changed files with 2 additions and 1 deletions
@@ -156,7 +156,8 @@ def flag_is_valid(c: Challenge, d: Description) -> list[str]:
    b = []
    content = str(d.flag.get("content") or "")
    if not FLAG_RE.match(content):
-        b.append(f"flag {content} is not h4tum{{...}}" if content else "no flag in description.yml")
+        # never print the content: a wrong prefix or stray whitespace still leaves a real flag
+        b.append("flag in description.yml is not h4tum{...}" if content else "no flag in description.yml")
    if d.flag.get("dynamic") and not any(isinstance(x.get("flag"), dict) for x in d.containers):
        b.append("dynamic flag, but no container is handed one")
    return b