3 ms·
as a non-rubiest, can you point to the error?
by sethammons 3y ago
as a non-rubiest, can you point to the error?
- Rapzid 3y agoRuby. I kid, but also I don't. Initially a single email could be passed into the API/form call and they would look it up. If found they would send a recovery to that email but it was the email the user supplied not what was in the DB. Oh, no problem we looked it up so they are the same! But then the ability to look up accounts from a list of emails was added. If any email matches the account lookup would succeed. Then they sent the reset link to that same user supplied value but OH NOEHS IT'S AN ARRAY NOW AND SOME MIGHT NOT HAVE MATCHED ACCOUNT EMAILS! So they ended up sending out reset links to a tainted list of emails. Rails "concerns" are the worst IMHO anyway, but looks like they aren't using strong params here either which is even worse. Also someone thought it was more elegant to reuse the tainted value which is par for the RoR course.
- szundi 3y agoOmg is this fix had to be this bloated?
- thedanbob 3y agoThis is actually a follow-up refactor, the fix is here: https://gitlab.com/gitlab-org/gitlab/-/commit/abe79e4ec437988cf16534a9dbba81b98a2e7f18 https://gitlab.com/gitlab-org/gitlab/-/commit/abe79e4ec43798...