Skip to content

fix: avoid disclosing existing emails#4555

Open
invinsibleDev wants to merge 1 commit into
Human-Connection:masterfrom
invinsibleDev:fix/email-exists-disclosure
Open

fix: avoid disclosing existing emails#4555
invinsibleDev wants to merge 1 commit into
Human-Connection:masterfrom
invinsibleDev:fix/email-exists-disclosure

Conversation

@invinsibleDev
Copy link
Copy Markdown

Summary

  • Return neutral success-shaped responses when signup or add-email receives an address already owned by an existing user.
  • Preserve the existing flow for unclaimed EmailAddress nodes.
  • Skip signup/email-verification mail sending when the resolver intentionally returns no nonce.

Fixes #1832

Validation

  • git diff --check
  • node --check backend/src/schema/resolvers/helpers/existingEmailAddress.js
  • node --check backend/src/schema/resolvers/emails.js
  • node --check backend/src/schema/resolvers/registration.js
  • node --check backend/src/middleware/email/emailMiddleware.js

Full backend Jest was not run because corepack yarn install --frozen-lockfile is currently blocked by a 404 while fetching the old Marak/faker.js GitHub tarball.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

🐛 [Bug] Unnecessary disclosure if email address exists

1 participant