Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Critical security: a couple of access control problems in the API and ws-server (details to be shared privately)

Aperta
  • Qualcosa non va?
#215 3 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@Anshuu2004 ci sta già lavorando.

Dal 27/10/2026.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
express, postgresql, typescript
Ambito
api, authentication, authorization, backend, security

Direzione di ricerca

The issue describes an unauthenticated read path and a WebSocket action that trusts a participant ID, but withholds the endpoint names, reproduction steps, and suggested patch. Ask the reporter for the private details and repro script first; use those to locate the API and WebSocket handlers and the failing test. Done means both access checks are covered by tests and legitimate client behavior still works.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

level3 nsoc26
Summary

While looking at Rexial's quiz flow I found two access control problems. One lets someone read data they should not be able to see without being logged in as the quiz owner, and the other lets a client act on behalf of another participant in a live session. I reproduced both locally (one against a real server and Postgres, one with a failing test).

I'm marking this critical and very important because it affects the fairness of live quizzes, which is the core thing the app does.

Why I'm not putting the details here

SECURITY.md asks us not to open public issues for vulnerabilities, so I'm keeping the exact endpoint and the steps out of this issue until there is a fix. I'll share them privately, along with the repro script and a suggested patch.

What I'd like to do
  • Fix both with the smallest change that closes them (auth check on the read path, and verifying the participant on the ws side instead of trusting the id in the message).
  • Add tests that fail now and pass after.
  • Keep the existing client behaviour for legitimate users.
Request
  1. Could a maintainer assign this to me so I can open a PR once we agree on the approach?
  2. Please tell me where to send the details. Private reporting looks switched off on the repo, so either enable it (Settings > Security > Private vulnerability reporting) or tell me which channel you want, and I'll send it right away.

Thanks!

Lingua principale
TypeScript
Stelle
21
Fork
7
Merge medio
5h 43m
PR unite (30g)
30

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di TheCodeHeist-Coder/Rexial

Tutte le issue di TheCodeHeist-Coder/Rexial

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.