Rename `decode` function `unsafeDecode` to highlight the risk
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript, node.js
- Domain
- security
Research direction
Start by locating the public decode and verify entry points in the JavaScript package and checking all references to decode. Confirm the compatibility and migration scope for unsafeDecode, then define completion as a consistent rename with updated callers and documentation.
Written by the indexing model from the issue text.
Description
Describe the problem you'd like to have solved
I'm a DevSec. I help developers teams find and fix their vulnerabilities.
In two of my last missions, I've seen developers using decode instead of verify even if the documentation has been improved.
Describe the ideal solution
To avoid this and reduce the vulnerable apps, I think it would be great to rename the decode function and call it unsafeDecode. (as suggested by @youssef-jbili)
Other libraries have done it and it helps developers reduce their mistakes:
dangerouslySetInnerHTMLfor ReactbypassSecurityTrustHtmlfor Angular
I can make a Pull Request if you think it is a good idea.
- Dominant language
- JavaScript
- Stars
- 18.2k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from auth0/node-jsonwebtoken
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
auth0/node-jsonwebtoken#1042 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
auth0/node-jsonwebtoken#1000 · 2 comments · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 65/100
auth0/node-jsonwebtoken#1046 ·
-
Difficulty 5/5 Over a week Newbie friendliness 10/100
auth0/node-jsonwebtoken#1034 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
auth0/node-jsonwebtoken#1032 ·
All issues in auth0/node-jsonwebtoken
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
mksglu/context-mode#1200 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
neondatabase/website#5944 ·
-
module: core
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
bigbluebutton/bigbluebutton#25849 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
jaegertracing/jaeger-ui#4506 ·