Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Critical security: a couple of access control problems in the API and ws-server (details to be shared privately)

Abierto
  • ¿Algo no está bien?
#215 3 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@Anshuu2004 ya está trabajando en esto.

Desde el 27/10/2026.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
express, postgresql, typescript
Área
api, authentication, authorization, backend, security

Línea de trabajo

The issue describes an unauthenticated read path and a WebSocket action that trusts a participant ID, but withholds the endpoint names, reproduction steps, and suggested patch. Ask the reporter for the private details and repro script first; use those to locate the API and WebSocket handlers and the failing test. Done means both access checks are covered by tests and legitimate client behavior still works.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

level3 nsoc26
Summary

While looking at Rexial's quiz flow I found two access control problems. One lets someone read data they should not be able to see without being logged in as the quiz owner, and the other lets a client act on behalf of another participant in a live session. I reproduced both locally (one against a real server and Postgres, one with a failing test).

I'm marking this critical and very important because it affects the fairness of live quizzes, which is the core thing the app does.

Why I'm not putting the details here

SECURITY.md asks us not to open public issues for vulnerabilities, so I'm keeping the exact endpoint and the steps out of this issue until there is a fix. I'll share them privately, along with the repro script and a suggested patch.

What I'd like to do
  • Fix both with the smallest change that closes them (auth check on the read path, and verifying the participant on the ws side instead of trusting the id in the message).
  • Add tests that fail now and pass after.
  • Keep the existing client behaviour for legitimate users.
Request
  1. Could a maintainer assign this to me so I can open a PR once we agree on the approach?
  2. Please tell me where to send the details. Private reporting looks switched off on the repo, so either enable it (Settings > Security > Private vulnerability reporting) or tell me which channel you want, and I'll send it right away.

Thanks!

Lenguaje dominante
TypeScript
Estrellas
21
Forks
7
Merge medio
5 h 43 min
PR fusionados (30 d)
30

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de TheCodeHeist-Coder/Rexial

Todos los issues de TheCodeHeist-Coder/Rexial

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.