grceng.academy
YAML lab 40 bonus XP

Specify closure of a previewer finding

Start labRead the room

Objectives

Halcyon Clinics' preview worker follows an approved external URL into the internal administration network. A manager marks the finding closed because the initial hostname is allowlisted and the browser uses strict origin rules. You must specify the server-side control and its evidence instead.

Use the fixture's policy constraints to fill every empty field. The plan must classify the root cause, name an accountable owner, constrain fetches, and retain a reproducible closure test. This is a declarative control plan, not executable networking code.

Finding and approved remediation policy

finding: preview fetch reaches internal administration through a redirect
owner_team: application-security
allowed_scheme: HTTPS only
redirect_policy: do not follow redirects
network_policy: deny private, loopback, and link-local destinations
closure_test: demonstrate a denied redirect to an internal destination
closure_record: retain test report and deployed release identifier

Checks the server runs (6)

  • Classify the server-side destination abuse
  • Assign the accountable team
  • Constrain scheme and redirect behavior
  • Cover all prohibited destination classes
  • Specify the denied internal redirect test
  • Retain test evidence linked to a release

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Locate the trust boundary

    Ask which risk family concerns a server being induced to contact an unintended destination, then identify the accountable team in the policy.

    Classify the server-side destination abuseAssign the accountable team

  2. Step 2

    Convert policy into constraints

    Use a protocol value and a YAML boolean for the two fetch settings. Check that the destination list covers every network scope prohibited by the fixture, not only the one reached in this incident.

    Constrain scheme and redirect behaviorCover all prohibited destination classes

  3. Step 3

    Make closure falsifiable

    Describe an adversarial navigation and the required failed outcome. Then identify the retained result and a nonempty identifier linking that result to the deployed change.

    Specify the denied internal redirect testRetain test evidence linked to a release

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.