Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Critical security: a couple of access control problems in the API and ws-server (details to be shared privately)

未关闭
  • 哪里不对？
#215 3 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@Anshuu2004 已经在做这个了。

开始于 2026年10月27日。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
35/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
express, postgresql, typescript
领域
api, authentication, authorization, backend, security

调研方向

The issue describes an unauthenticated read path and a WebSocket action that trusts a participant ID, but withholds the endpoint names, reproduction steps, and suggested patch. Ask the reporter for the private details and repro script first; use those to locate the API and WebSocket handlers and the failing test. Done means both access checks are covered by tests and legitimate client behavior still works.

由索引模型根据 Issue 内容生成。

描述

level3 nsoc26
Summary

While looking at Rexial's quiz flow I found two access control problems. One lets someone read data they should not be able to see without being logged in as the quiz owner, and the other lets a client act on behalf of another participant in a live session. I reproduced both locally (one against a real server and Postgres, one with a failing test).

I'm marking this critical and very important because it affects the fairness of live quizzes, which is the core thing the app does.

Why I'm not putting the details here

SECURITY.md asks us not to open public issues for vulnerabilities, so I'm keeping the exact endpoint and the steps out of this issue until there is a fix. I'll share them privately, along with the repro script and a suggested patch.

What I'd like to do
  • Fix both with the smallest change that closes them (auth check on the read path, and verifying the participant on the ws side instead of trusting the id in the message).
  • Add tests that fail now and pass after.
  • Keep the existing client behaviour for legitimate users.
Request
  1. Could a maintainer assign this to me so I can open a PR once we agree on the approach?
  2. Please tell me where to send the details. Private reporting looks switched off on the repo, so either enable it (Settings > Security > Private vulnerability reporting) or tell me which channel you want, and I'll send it right away.

Thanks!

主要语言
TypeScript
星标
21
派生
7
平均合并
5 小时 43 分钟
30 天内合并 PR
30

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

TheCodeHeist-Coder/Rexial 的其他 Issue

查看 TheCodeHeist-Coder/Rexial 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。