Double check of potential problems in backend

rclarey / waterloooasis

0 stars 0 forks source link

Double check of potential problems in backend #41

Open rclarey opened 5 years ago

rclarey commented 5 years ago

These include:

inadequate error handling anywhere
SQL injection vulnerabilities
persistent XSS vulnerabilities
or anything else deemed bad

danenespoli commented 5 years ago

Oh also double check that the "@edu.uwaterloo" part of the email address isn't being appended client-side (or at least that it's validated on the backend somewhere)

I feel like I saw code at some point that appended the uwaterloo part before making the API call to create a user and just wanted to make sure users can't sign up with arbitrary email addresses if they bypass this

rclarey commented 5 years ago

@danenespoli yeah we append it client-side, but we do validate it on the backend.

Now that you've pointed it out I agree that we should just send the WatIAM ID