validateRideLength accepts any Object.prototype key as a ride length
维护者通常 7 天内回复
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 78/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 冷清
- 技术栈
- javascript
调研方向
从 app/models/calEventValidator.js 中的 validateRideLength 开始，并在 app 目录中运行 issue 中的 node 复现。针对列出的真实值和 Prototype-Key 值，检查 own-property 验证和局部变量行为。完成的标准是：有效的乘车长度仍然通过，prototype 键被拒绝，并且不会创建全局值。
由索引模型根据 Issue 内容生成。
描述
validateRideLength uses the in operator to check a submitted ride length against the known values. in walks the prototype chain, so alongside the four real lengths it also accepts every property inherited from Object.prototype — toString, constructor, hasOwnProperty, valueOf, __proto__ — and returns them unchanged, with no validation error.
Those values reach the database and are rendered back on the event page.
Reproducing
From the app directory:
node -e "
const { makeValidator, ErrorCollector } = require('./models/calEventValidator');
for (const v of ['0-3', 'bogus', 'toString', 'constructor', '__proto__']) {
const errors = new ErrorCollector();
const got = makeValidator({ ridelength: v }, errors).validateRideLength('ridelength');
console.log(JSON.stringify(v).padEnd(15), '->', JSON.stringify(got));
}"
On main this prints:
"0-3" -> "0-3" (correct)
"bogus" -> null (correctly rejected)
"toString" -> "toString" (should be null)
"constructor" -> "constructor" (should be null)
"__proto__" -> "__proto__" (should be null)
hasOwnProperty and valueOf behave the same way. None of them record a validation error.
It reaches the database and the page
Posting an otherwise valid event to manage_event with ridelength: "constructor" (payload shape per CALENDAR_API.md) returns 200, and reading the event back through retrieve_event confirms it stored:
ridelength: "constructor"
EventDetails.vue renders the field directly:
rideLength() {
if (this.evt.ridelength) {
return `${this.evt.ridelength} miles`;
}
so the event details page then displays "constructor miles".
Cause
app/models/calEventValidator.js:
validateRideLength(rideLength) {
value = getString(rideLength);
return (value in RideLength) ? value : null;
}
RideLength is an ordinary frozen object, so it still inherits from Object.prototype, and in finds those inherited keys.
A second, smaller problem in the same function
value is assigned without const/let, so it becomes an implicit global on every call — confirmed with globalThis.value === "0-3" after one call. It is harmless today only because this file is non-strict CommonJS; it would throw a ReferenceError under ESM or "use strict", which is where the rest of the project is heading.
Suggested fix
Use an own-property check, and declare the local:
- validateRideLength(rideLength) {
- value = getString(rideLength);
- return (value in RideLength) ? value : null;
- },
+ validateRideLength(field) {
+ const value = getString(field);
+ return Object.hasOwn(RideLength, value) ? value : null;
+ },
Severity
Low. The column is a varchar, and Vue escapes its output, so this is bad data rather than injection — an organizer can write arbitrary prototype-key strings into a public field on their own ride. Worth fixing because it is small, and because the same in-instead-of-own-property pattern is easy to copy into somewhere it matters more.
Not changed
Unlike the other validators, this one silently returns null for an unrecognised value rather than recording an error via errors.addError(field). That may well be deliberate — rejecting a bad ride length outright would fail the whole save — so I have left the behaviour alone. Flagging it in case it should be revisited separately.
- 主要语言
- JavaScript
- 星标
- 30
- 派生
- 26
- 平均合并
- 6 天 24 分钟
- 30 天内合并 PR
- 6
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
shift-org/shift-docs 的其他 Issue
-
Export links and the webcal feed 404 under npm run dev可能已有人在做 @dduugg 于 4 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 83/100
shift-org/shift-docs#1121 ·
维护者通常 7 天内回复
-
Unknown --db values report a TypeError instead of the intended error可能已有人在做 @gangster 于 76 天前认领。 未关闭
难度 1/5 1 小时以内 新手友好度 88/100
shift-org/shift-docs#1091 ·
维护者通常 7 天内回复
-
Favorites page fetches every favorite because getDaily's guard is inverted可能已有人在做 @gangster 于 76 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
shift-org/shift-docs#1087 ·
维护者通常 7 天内回复
-
难度 4/5 3-5 天 新手友好度 48/100
shift-org/shift-docs#1126 ·
维护者通常 7 天内回复
-
Address npm audit vulnerabilities (nodemailer, multer, express deps)可能已有人在做 @gangster 于 5 天前认领。 未关闭
难度 4/5 3-5 天 新手友好度 35/100
shift-org/shift-docs#1118 · 1 条评论 ·
维护者通常 7 天内回复
查看 shift-org/shift-docs 的全部 Issue
相似的 Issue
-
task
难度 1/5 1 小时以内 新手友好度 83/100
TAMULib/fw-registry#550 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 79/100
-
NWCWalletService.subscribe: response is never published if the handler finishes after unsubscribe (regression in 8.1.0)可能已有人在做 @ajaysehwal 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 83/100
-
难度 1/5 1 小时以内 新手友好度 88/100
bigskysoftware/htmx#4151 ·
维护者通常 4 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100