Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Critical security: a couple of access control problems in the API and ws-server (details to be shared privately)

Offen
  • Stimmt etwas nicht?
#215 3 Kommentare 0 Reaktionen 1 zugewiesene Person Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

@Anshuu2004 arbeitet bereits daran.

Seit 27.10.2026.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
35/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
express, postgresql, typescript
Bereich
api, authentication, authorization, backend, security

Rechercherichtung

The issue describes an unauthenticated read path and a WebSocket action that trusts a participant ID, but withholds the endpoint names, reproduction steps, and suggested patch. Ask the reporter for the private details and repro script first; use those to locate the API and WebSocket handlers and the failing test. Done means both access checks are covered by tests and legitimate client behavior still works.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

level3 nsoc26
Summary

While looking at Rexial's quiz flow I found two access control problems. One lets someone read data they should not be able to see without being logged in as the quiz owner, and the other lets a client act on behalf of another participant in a live session. I reproduced both locally (one against a real server and Postgres, one with a failing test).

I'm marking this critical and very important because it affects the fairness of live quizzes, which is the core thing the app does.

Why I'm not putting the details here

SECURITY.md asks us not to open public issues for vulnerabilities, so I'm keeping the exact endpoint and the steps out of this issue until there is a fix. I'll share them privately, along with the repro script and a suggested patch.

What I'd like to do
  • Fix both with the smallest change that closes them (auth check on the read path, and verifying the participant on the ws side instead of trusting the id in the message).
  • Add tests that fail now and pass after.
  • Keep the existing client behaviour for legitimate users.
Request
  1. Could a maintainer assign this to me so I can open a PR once we agree on the approach?
  2. Please tell me where to send the details. Private reporting looks switched off on the repo, so either enable it (Settings > Security > Private vulnerability reporting) or tell me which channel you want, and I'll send it right away.

Thanks!

Vorherrschende Sprache
TypeScript
Sterne
21
Forks
7
Ø Merge
5 Std. 35 Min.
Gemergte PRs (30 T.)
33

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus TheCodeHeist-Coder/Rexial

Alle Issues in TheCodeHeist-Coder/Rexial

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.