Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixed group array mutation on call to validator middleware #274

Open
wants to merge 1 commit into
base: 2023-root-v2
Choose a base branch
from
Open

Fixed group array mutation on call to validator middleware #274

wants to merge 1 commit into from

Commits on Jan 5, 2023

  1. Fixed bug where global variable in validateGroup was mutated after … 

    …every call to the middleware function, causing a "memory leak" in a sense.

The bug was a result of the admin role being pushed to the `group` array every time an endpoint using that particular validator was invoked. The fix for this was to move these operations outside the closure, since they really only need to be executed once.

This bug isn't particularly dangerous on face level, but if someone were to spam the API then the server could potentially start running out of memory.

Reproducing the bug from an account without proper authorization to use an endpoint:
```
$ curl 'https://root.treehacks.com/api/judges'  ...
Unauthorized; user is not in group admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin.%
$ curl 'https://root.treehacks.com/api/judges'  ...
Unauthorized; user is not in group admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin.%
```
Notice how the number of `admin`s gets a bit longer? That doesn't look right 🧐
    @henrytwo
    henrytwo committed Jan 5, 2023
    Configuration menu
    Copy the full SHA
    d45c1d6 View commit details
    Browse the repository at this point in the history