Close a draft-roster leak, CSV formula injection, and stale role caches - #427
Merged
Merged
Conversation
- Resume book index.csv: names, schools and majors are member-typed, and a leading = + - @ made Excel/Sheets run it as a formula when staff opened the file (e.g. =HYPERLINK exfiltrating the row). Such cells now get a leading apostrophe. - hackathon.participants (public) and team.list skipped assertHackathonVisible, which the schedule, gallery and results already apply, so anyone holding a draft edition's uuid could list its participants and teams. Both now answer NOT_FOUND for a draft to non-staff. - judge.create and judge.remove did not clear the judge role cache or portal context (only approval did), so a new judge waited up to 5 minutes for the Judge tab and a removed one kept a tab every procedure refused. - clearMembershipCaches now also evicts member:history:<id> and the staff directory (members:list:*), which only ever expired.
aamoghS
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Findings from an API audit, each verified against the code.
index.csv): member-typed names/schools/majors starting with= + - @ran as formulas when staff opened the file in Excel/Sheets (e.g.=HYPERLINKleaking the row). Those cells now get a leading apostrophe.hackathon.participants(public) andteam.listskippedassertHackathonVisible, which schedule/gallery/results already apply. Anyone with a draft edition's uuid could list its participants and teams. Now NOT_FOUND for non-staff.judge.create/judge.removedidn't clear the role cache or portal context (only approval did): new judges waited up to 5 min for the Judge tab; removed judges kept a tab that every procedure refused.clearMembershipCachesnow also evictsmember:history:<id>and the staff directory (members:list:*), which previously only expired.Tests
Updated three roster tests to use a visible edition; added "hides a draft hackathon's participant list". Typecheck 9/9, lint 8/8,
pnpm test829 passing.