Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prevent accidental search of user's passphrase #1813

Closed
slaweet opened this issue Mar 11, 2019 · 1 comment
Closed

Prevent accidental search of user's passphrase #1813

slaweet opened this issue Mar 11, 2019 · 1 comment
Assignees
@osvaldovega
Labels
type: security
Milestone
Version 1.16.0 - ...

Comments

@slaweet
Copy link
Contributor

slaweet commented Mar 11, 2019 •
edited

Currently, a user can paste accidentally passphrase into the search field and it will be used as a search term and sent to a server.

This should be avoided by not making the API request for delegate name if entered search term doesn't match the delegate name regex https://github.com/LiskHQ/lisk-hub/blob/93c9b0a386e47c258ff4ed77a8ad576aa720b0f5/src/components/registerDelegate/steps/choose/choose.js#L22 This will solve the problem because a delegate name doesn't allow spaces and passphrase require spaces, so there is an empty intersection of the two.

BTW the delegate name regex should be defined in this file https://github.com/LiskHQ/lisk-hub/blob/development/src/utils/regex.js and then the regex can be handled same as for Lisk ID and TxID in https://github.com/LiskHQ/lisk-hub/blob/93c9b0a386e47c258ff4ed77a8ad576aa720b0f5/src/utils/api/search.js#L44-L48
@slaweet slaweet added this to the Version 1.15.0 milestone Mar 29, 2019
@osvaldovega osvaldovega mentioned this issue Apr 1, 2019
Merged
@slaweet slaweet modified the milestones: Version 1.15.0, Version 1.16.0 Apr 5, 2019
osvaldovega pushed a commit that referenced this issue Apr 15, 2019
Merge pull request #1864 from LiskHQ/1774-implement-the-new-search
f4045f0 
Implement the new search - Closes #1774 #1813
@osvaldovega
Copy link
Contributor

issue fixed in PR #1864

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@osvaldovega osvaldovega

Labels
type: security
Projects
None yet
Milestone
Version 1.16.0 - New Search dropdown,...
Development

No branches or pull requests
2 participants
@slaweet @osvaldovega