recoverEmail handler passes action code into the wrong parameter

Open Beginner friendly
#8,299 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
76/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
javascript
Domain
authentication

Research direction

Read email-handler.html, starting at the recoverEmail switch branch and the handleRecoverEmail entry point. Trace the arguments through checkActionCode and applyActionCode, then verify a valid email-recovery URL completes the revert-email flow without an undefined action code.

Written by the indexing model from the issue text.

Description

Looks like the recoverEmail path in email-handler.html is passing the action code into the wrong parameter.

handleRecoverEmail is defined as:

function handleRecoverEmail(auth, actionCode, lang) {

But the switch calls it like this:

handleRecoverEmail(actionCode);

Inside the handler, checkActionCode(Auth, actionCode) and applyActionCode(Auth, actionCode) use the second parameter, so actionCode ends up being undefined for recover email links.

How to reproduce:

  1. Open an email recovery link that uses /email-handler?mode=recoverEmail&oobCode=<valid code>.
  2. The handler enters the recoverEmail branch.
  3. handleRecoverEmail receives only one argument.
  4. Firebase receives undefined as the action code, so the email recovery flow fails instead of reverting the email.

Impact is limited, but this does affect account recovery. If a user's email was changed accidentally or maliciously, the recovery link may not work through Monkeytype's handler. I do not think this is account takeover by itself.

A fix would be to either call handleRecoverEmail(Auth, actionCode, lang) or simplify the function signature so the action code is the first argument.

Dominant language
TypeScript
Stars
20.7k
Forks
3.3k
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from monkeytypegame/monkeytype

All issues in monkeytypegame/monkeytype

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.