This is a stripped-down version of a single section of Grok TiddlyWiki, optimized for fast loading and readability by search engines. Some features are missing.

For the full Grok TiddlyWiki experience, please visit the wiki version of this page.

Ex:BypassSecurityWithTextSubstitution

 28th September 2024 at 7:26pm

Suppose that the following macro is being used to validate whether the user is authorized to access something:

\define checkAuthorization(password)
<% if [[$password$]match{$:/config/SecretPasswordExample}] %>
  The user is authorized.
<% endif %>
\end

<<checkAuthorization "">>

Because of the way text substitution works, it's possible to bypass this authentication check without knowing the password (or looking in that tiddler). Figure out what you can fill in between the quotation marks in the macro call to bypass the password check, and check your answer by editing the live example above.

Go to answer: Ex:BypassSecurityWithTextSubstitution/answer