[ismisepaul]

⚠️ Manual testing required before merging

The integration tests ran against real MongoDB 4.1.13 and 8.0.32, but nobody has played the NoSQL challenge end to end in the full app on this stack, and the 4.1 → 8.0 upgrade of an existing environment hasn't been tried.

Please run this branch, follow the steps, and comment on this PR with the result: pass, or the step that failed and what you saw.

Branch: dev#992-nosql-shared-client

This PR is part of a stack (#1007, then #1008, then #1009, then #1019). Each branch contains the ones below it, so testing the top branch, dev#992-nosql-shared-client, covers the whole stack. To test only this PR, use its own branch.

This PR on its own: step 6.

Set up. Use a machine where the Shepherd Docker volumes can be thrown away: down -v deletes their data. JDK 17 and Maven 3.9.2+ are needed.

git fetch origin
git checkout 'dev#992-nosql-shared-client'
mvn -Pdocker clean install -DskipTests
docker compose down -v
docker compose up -d --build

1. Open https://localhost, accept the self-signed certificate warning, log in as admin / password and set a new password when asked.
2. On the Get Started page, tick Enable Unsafe Levels and click Open All Levels.
3. Admin → Module Management → Change Module Layout → Open Floor, then reload the page, so every level is listed on the left.

Test

1. Run docker exec secshep_mongo mongod --version. It should say v8.0.32.
2. Open NoSQL Injection One and submit ';return(true);var a='a. It should list every gamer, including the row with the result key.
3. Submit the same input three more times. It must work every time. Before [BUG] NoSQL Injection 1 only answers once per Tomcat run: the servlet closes the shared MongoClient #992, every submission after the first failed until Tomcat restarted.
4. Submit a single gamer ID from the list. Only that gamer should be shown. Then submit ': an error message, not a hang.
5. Upgrade path: on an environment that was already running on dev (MongoDB 4.1), check out this branch and follow the README's MongoDB 8.0 section (remove the mongodata volume, rebuild). The mongo container must start and step 2 must work.
6. Integration-test image (it-test profile tags its Mongo build as mongo:${MONGODB_VERSION}, breaking the next local IT run #938): run mvn verify -DskipUTs=true -DmongoDocker -B twice in a row against the test database from AGENTS.md. The second run must not fail with chown ... Operation not permitted, and docker images mongo must still show the official image.

It's broken if: the NoSQL level doesn't list the gamers for the injection, stops answering after the first submission, or the mongo container doesn't start after the upgrade steps.

---

PR 3 of #958. Stacked on the server PR. Fixes #938.

What

The it-test profile (-DmongoDocker) tagged the image it builds as mongo:${MONGODB_VERSION}. That's the same tag as the official image its Dockerfile builds FROM, so after one local run the next build failed with chown … Operation not permitted.

• The image is now ${IMAGE_MONGO}:it (owasp/security-shepherd_mongo:it). Compose uses :latest, so they don't clash.
• containerNamePattern %a-%i with alias mongo keeps the container name mongo-1. The plugin's default would name it after the image (security-shepherd_mongo-1), which the clean-up filter in AGENTS.md (^mongo-[0-9]+$) doesn't match. Checked: docker:start creates mongo-1, and docker:stop removes it.
• AGENTS.md: the "overwrites the tag / restore before every run" instructions are replaced by one note about the new name, plus a one-off restore command for a tag that is already overwritten.

Tests

• Every step of test.yml passed locally on this branch.
• After the run, the official mongo:8.0.32 still has its registry digest.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

The explicitly requested validation of two consecutive Docker integration-test runs still needs human confirmation before merging.

No open issues 🎉

What changed in this PR

This PR isolates the MongoDB integration-test image from the official base image, addressing #938 within the MongoDB upgrade stack.

Changes:

• Tags the test image as ${IMAGE_MONGO}:it, preventing builds from overwriting the official MongoDB tag.
• Preserves the mongo-1 container name so existing cleanup commands still work.
• Updates troubleshooting guidance to retain only the one-time recovery step for previously overwritten tags.

File	Description
pom.xml	Gives the integration-test image a separate tag and preserves container naming.
AGENTS.md	Documents the new image name and removes the recurring tag-restoration workaround.

_{Review effort: Balanced}