FrankerFaceZ / Add-Ons

Add-Ons are additional modules for FrankerFaceZ that provide new behaviors and ways to customize Twitch.
66 stars 58 forks source link

[Pronouns] `channel_id` is not checked #202

Open liquidnya opened 6 months ago

liquidnya commented 6 months ago

Note that I have not reproduced the bug and I am reporting the bug just from analyzing the code by reading it. I was reading through src/pronouns/index.jsx at commit ce5c9ee, because I was curious how multiple pronouns will be rendered. And I noticed that channel_id is not used from the JSON response of https://api.pronouns.alejo.io/v1/users/${login}. I think this means the following:

  1. Someone registers their pronouns on https://pronouns.alejo.io/
  2. They rename their account
  3. After about 6 months when the name is available again someone else registers or renames an account with the same username
  4. My assumption is that the pronouns of the first account will show up instead of no pronouns showing up (which is what I would expect)

Currently I have done step 1 and 2, and I am waiting 6 months to reproduce the bug.

I think the following changes could be made to address this issue:

Add the userId to the signature of the _getUser function. Then check if both the userId is not undefined/null and data?.channel_id is not undefined/null and if they are both present and don't match, then the data is from a user which used to have the same username as the user and in this case null could be returned from _getUser.

async _getUser(login, userId) {
  ...
  if (userId && data?.channel_id && userId != data?.channel_id)
    return null;
  }
  ...
}

Then the getUser function would need to get a userId as well like

getUser(login, userId = null, multiple_waits = false) {
...
}

and then everywhere getUser is called the call need to be adjusted to include the new argument and whenever the user ID is known it could be provided, like for example in onMessage the user ID is user.id.