Email action token signature compared with !==
Maintainers usually reply within 1 day
A pull request for this has already been merged.
- #182 by @natos — merged
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 82/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- next.js, typescript
Research direction
Start in src/lib/email-tokens.ts at verifyEmailAction and review how it computes and compares the HMAC signatures. Add the length check and constant-time comparison described in the issue, then add a test for the verification behavior. Done when the test confirms valid signatures still pass and invalid signatures fail.
Written by the indexing model from the issue text.
Description
verifyEmailAction in src/lib/email-tokens.ts compares HMAC signatures with !==, which is not constant-time. Low practical risk over the network, but trivial to fix.
Fix. Compare with crypto.timingSafeEqual after a length check; add a test.
- Dominant language
- TypeScript
- Stars
- 3
- Forks
- 6
- Avg merge
- 13h 29m
- Merged PRs (30d)
- 56
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from grasshopper-protocol/grsshppr
-
bug UX
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
grasshopper-protocol/grsshppr#209 ·
Maintainers usually reply within 1 day
-
Add tests for utils.ts cn() functionPossibly taken @yogesh201sits claimed this 6 days ago. Opengood first issue testing
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
grasshopper-protocol/grsshppr#81 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
code quality documentation good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
grasshopper-protocol/grsshppr#78 ·
Maintainers usually reply within 1 day
-
a11y documentation good first issue UI
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
grasshopper-protocol/grsshppr#77 ·
Maintainers usually reply within 1 day
-
good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
grasshopper-protocol/grsshppr#46 ·
Maintainers usually reply within 1 day
All issues in grasshopper-protocol/grsshppr
Similar issues
-
area: server priority: P3 type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
appandflow/stim#4538 ·
Maintainers usually reply within 1 day
-
[BUG] Published Docker images lack the redis extra: HEADROOM_COMPRESS_SESSION_STORE stops startupPossibly taken @AlessandroSpallina claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
headroomlabs-ai/headroom#4513 ·
Maintainers usually reply within 1 day
-
bug extension extension: obsidian platform: Windows
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
raycast/extensions#32838 · 1 comment ·
Maintainers usually reply within 1 day
-
copy design-review mac P3
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
tosunlab/hisarapp-core#510 ·
-
bug priority-medium to-agent
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day