Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enqueue transfer requests (to prevent accepting them all without review) #34

Open
nekohayo opened this issue May 23, 2022 · 1 comment

Comments

@nekohayo
Copy link

Here's a small security issue. If you have three computers, and from two of the three you throw files at the third one at roughly the same time, the third computer will be prompted only once to accept the (first) transfer, but the 2nd transfer will get accepted along with them without review.

@sireliah
Copy link
Owner

I couldn't reproduce this locally on one machine now, but I suspect the issue is here.

That is:

  1. Sender ---- ([Metadata] I'm sending you hash xxxx) ----> Receiver
  2. Receiver (gets the user approval for the hash xxxx)
  3. Sender <--- ([Metadata] I'm accepting hash xxxx) ----- Receiver
  4. Sender ---- (sends whatever on the opened substream) ----> Receiver
  5. FIN
  • On the point 4. we might check what the Receiver actually accepted and send only the matching payload over the substream.

Although this doesn't solve the underlying problem with the receiver acceptance flow. I'll try to dig this a bit more.

Meanwhile while testing 3 peers I discovered that sending payloads from two peers to third one, the notification popup is not closed and prevents you from using the application, so you need to kill the app.

  • Fix the bug with Yes/No popup not being closed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants