Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

[Bug]: Client-supplied timeMs is trusted when awarding points

クローズ
  • 何か問題がありますか？
#157 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@chenzeyan54-commits がすでに取り組んでいます。

2026年9月26日 から。

  • #163 @chenzeyan54-commits による — オープン

評価

難易度
3/5
見積もり時間
半日
初心者へのやさしさ
25/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
停滞
技術スタック
redis, typescript
領域
backend, security

調査の方向性

Start in apps/ws-server/src/utils/handleMessages.ts, in the quiz:submit-answer handler, where points are computed from the client's timeMs. Read timeManager.ts to see how quiz:deadline:<sessionId> is stored in Redis, since the server-side elapsed time and the late-answer check depend on it. Done means a crafted timeMs no longer changes the score, late or non-current-question answers score nothing or are rejected, and honest scores are unchanged. Pull request #163 is already open against this issue, so check it before starting.

索引モデルが issue の本文から書いたものです。

説明

bug enhancement help wanted
What happened?

Scoring uses a value the client computes and sends.

apps/frontend/src/screens/LiveQuiz.tsx:265:

const timeMs = Date.now() - questionStartTime;

apps/ws-server/src/utils/handleMessages.ts, in quiz:submit-answer:

const points = isCorrect ? Math.max(10, 1_000 - timeMs) : 0;

Anyone can send timeMs: 0 and score the maximum 1000 points on every question
regardless of how long they actually took. A negative value is not rejected
either.

There is a second, subtler problem: the server never checks that the question is
still open. A late answer — after the timer expired, or for a previous question
— is accepted and scored, as long as no row exists yet for that
(participantId, questionId).

Steps to reproduce

Suggested fix. The server already knows the deadline. timeManager.ts writes
quiz:deadline:<sessionId> to Redis, which is exactly what is needed:

  • Compute elapsed time server-side from the stored deadline and the question's
    timeLimit, and ignore timeMs from the payload entirely
  • Reject a submission whose questionId is not the session's current question
  • Reject a submission arriving after the deadline has passed

Definition of done:

  • A crafted timeMs: 0 no longer affects the score
  • An answer submitted after the timer expires scores nothing
  • An answer for a non-current question is rejected
  • Honest clients see no change in their scores

Worth pairing with issue 1 — same file, same handler, and both are about not
trusting the client.

Which part of Rexial?

ws-server (WebSockets), http-server (Express REST API)

How are you running Rexial?

Docker Compose (docker-compose up)

Logs or error output
Environment

No response

Before submitting
  • I searched existing issues and this has not been reported
  • I am not including any secrets, API keys or passwords in this report
主要言語
TypeScript
スター
21
フォーク
7
平均マージ
5時間 19分
マージ済み PR（30日）
29

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

TheCodeHeist-Coder/Rexial のほかの issue

TheCodeHeist-Coder/Rexial の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。