Skip to content

Fix #1115: optimize table rendering, cache score, purge/minify css/js, and enable virtual threads - #2718

Merged
commjoen merged 13 commits into
OWASP:masterfrom
bhushan4work:fixes#1115
Oct 11, 2026
Merged

commjoen merged 13 commits into
OWASP:masterfrom
bhushan4work:fixes#1115

Conversation

@bhushan4work

Copy link
Copy Markdown
Contributor

What kind of changes does this PR include?

  • Fixes or refactors
  • A new challenge
  • Additional documentation
  • Something else

Description

Improves main-screen loading and rendering performance by:

  • pre-compiling and reusing static challenge table data
  • minifying first-party JavaScript and CSS
  • removing unused Bootstrap CSS
  • caching the computed score value
  • deferring non-critical JavaScript to reduce render blocking
  • enabling Spring virtual threads

Existing session-dependent behavior and UI functionality are preserved.

Relations

Closes #1115

References

Checklist:

  • All the contributions made are solely the work of me and my co-authors
  • I used AI to generate parts of the content.
  • I tested the changes in this PR (if applicable)
  • I added unit tests to ensure my change works (when change in Java or on front-end code)
  • I added UI tests to ensure my UI changes work (when change in the overall UI, not needed if just adding a challenge)
  • The PR passes pre-commit hooks and automated tests

@commjoen

commjoen commented Oct 3, 2026

Copy link
Copy Markdown
Collaborator

Thank you @bhushan4work , hope to look at this somewhere next week :)

@commjoen

commjoen commented Oct 5, 2026

Copy link
Copy Markdown
Collaborator

@bhushan4work awesome work! Can you fix the failing tests please? then i will do some testing later on this week :)

@bhushan4work

bhushan4work commented Oct 5, 2026 •

Copy link
Copy Markdown
Contributor Author

fixed the 2 failing tests and verified both fixes. the changes are ready for you to test whenever you get time this week.
thanks

bhushan4work and others added 4 commits October 5, 2026 19:36
The deferred jquery script tag broke the inline challenge-16 snippet, which
uses $ while the page is still parsing, and failed Cypress with
"$ is not defined". jQuery now loads synchronously again; the other scripts
stay deferred.

Post the visual-diff PR comment inside a try/catch: when the workflow token
has no comment permission (401/403) the result is published to the job
summary instead of failing the run, while other errors still fail the step.
@github-actions

github-actions Bot commented Oct 6, 2026 •

Copy link
Copy Markdown

🧪 Testing this PR locally

If you already have the repository

First, make sure the official OWASP WrongSecrets repository is configured
as the wrongsecrets-upstream remote:

git remote get-url wrongsecrets-upstream >/dev/null 2>&1 || \
  git remote add wrongsecrets-upstream https://github.com/OWASP/wrongsecrets.git

Then fetch and check out this PR:

git fetch wrongsecrets-upstream pull/2718/head:pr-2718
git checkout pr-2718

If you already have a wrongsecrets-upstream remote, the first command
leaves it unchanged.

Or, if you want the contributor branch directly

If the contributor repository is already configured as origin:

git fetch origin
git checkout -b test-pr-2718 origin/fixes#1115

🧹 Cleaning up after testing

When you are finished testing, you can remove the local PR branch:

git checkout main
git branch -D pr-2718

If you added the wrongsecrets-upstream remote specifically for testing
this PR and no longer need it, remove it with:

git remote remove wrongsecrets-upstream

⚠️ Only remove wrongsecrets-upstream if you added it for this test.
If you already had this remote before testing, keep it.

PR: #2718
Branch: fixes#1115
Repository: bhushan4work/wrongsecrets

@commjoen

commjoen commented Oct 7, 2026

Copy link
Copy Markdown
Collaborator

hi @bhushan4work i am a little bit more busy at work and in personal life than expected, i hope to review the last 2 PRs in the upcoming weeks. Simple challenges can be reveiwed quite fast, but other things will take a little longer, apologies!

@bhushan4work

Copy link
Copy Markdown
Contributor Author

No worries at all, completely understand! Take your time with the reviews. Thanks for the update

commjoen and others added 7 commits October 8, 2026 12:34
The shared challenge list must reflect each visitor's own progress after a solve, so cover two sessions through rendered pages.

Closes: OWASP#1115
Repeated parsing adds avoidable work to main-screen requests while each visitor still needs session-specific output.

Closes: OWASP#1115
Challenges at the same difficulty repeat identical star strings, and each challenge has a fixed environment label. Avoid rebuilding these values during page rendering.

Closes: OWASP#1115
The virtual-thread setting applied to only one profile, so normal deployments still used Tomcat platform threads.

Closes: OWASP#1115
Requests on the dedicated MCP port otherwise keep using platform threads even when virtual threads are enabled for the application.

Closes: OWASP#1115

@commjoen commjoen left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there still seem to be some issue but let me fix that in the master branch. thanks!

@commjoen
commjoen merged commit 86d03d6 into OWASP:master Oct 11, 2026
21 of 23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

performance for the main screen load

2 participants