Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug]: Client-supplied timeMs is trusted when awarding points

Chiusa
  • Qualcosa non va?
#157 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@chenzeyan54-commits ci sta già lavorando.

Dal 26/9/2026.

  • #163 di @chenzeyan54-commits — aperta

Valutazione

Difficoltà
3/5
Tempo stimato
Mezza giornata
Idoneità per principianti
25/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Ferma
Stack tecnologico
redis, typescript
Ambito
backend, security

Direzione di ricerca

Start in apps/ws-server/src/utils/handleMessages.ts, in the quiz:submit-answer handler, where points are computed from the client's timeMs. Read timeManager.ts to see how quiz:deadline:<sessionId> is stored in Redis, since the server-side elapsed time and the late-answer check depend on it. Done means a crafted timeMs no longer changes the score, late or non-current-question answers score nothing or are rejected, and honest scores are unchanged. Pull request #163 is already open against this issue, so check it before starting.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug enhancement help wanted
What happened?

Scoring uses a value the client computes and sends.

apps/frontend/src/screens/LiveQuiz.tsx:265:

const timeMs = Date.now() - questionStartTime;

apps/ws-server/src/utils/handleMessages.ts, in quiz:submit-answer:

const points = isCorrect ? Math.max(10, 1_000 - timeMs) : 0;

Anyone can send timeMs: 0 and score the maximum 1000 points on every question
regardless of how long they actually took. A negative value is not rejected
either.

There is a second, subtler problem: the server never checks that the question is
still open. A late answer — after the timer expired, or for a previous question
— is accepted and scored, as long as no row exists yet for that
(participantId, questionId).

Steps to reproduce

Suggested fix. The server already knows the deadline. timeManager.ts writes
quiz:deadline:<sessionId> to Redis, which is exactly what is needed:

  • Compute elapsed time server-side from the stored deadline and the question's
    timeLimit, and ignore timeMs from the payload entirely
  • Reject a submission whose questionId is not the session's current question
  • Reject a submission arriving after the deadline has passed

Definition of done:

  • A crafted timeMs: 0 no longer affects the score
  • An answer submitted after the timer expires scores nothing
  • An answer for a non-current question is rejected
  • Honest clients see no change in their scores

Worth pairing with issue 1 — same file, same handler, and both are about not
trusting the client.

Which part of Rexial?

ws-server (WebSockets), http-server (Express REST API)

How are you running Rexial?

Docker Compose (docker-compose up)

Logs or error output
Environment

No response

Before submitting
  • I searched existing issues and this has not been reported
  • I am not including any secrets, API keys or passwords in this report
Lingua principale
TypeScript
Stelle
21
Fork
7
Merge medio
5h 19m
PR unite (30g)
29

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di TheCodeHeist-Coder/Rexial

Tutte le issue di TheCodeHeist-Coder/Rexial

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.