Skip to content

[Bug] verifyConnection trusts client handle instead of stored pending handle — uniqueness bypass #304

Description

@vedant7007

Problem (Low/Med — inconsistent state, uniqueness bypass)

server/modules/codeforces/service.js:201-239 (verifyConnection) — the pending profile is loaded by userId (:203), but re-verification (:215), setUserCodeforcesHandle (:239) and the background syncUserData (:242) all use handle from req.body, not profile.handle.

The duplicate-handle uniqueness guard ("already connected to another account") exists only in initiateConnection (:160-166) against the initiate handle; the verify path binds whatever handle the client sends and never re-checks uniqueness. This lets the finally-bound handle diverge from the one that passed the uniqueness check, producing inconsistent state.

Suggested fix (tiny)

Use profile.handle throughout verifyConnection; ignore or validate the request-body handle against it.

Happy to fix under GSSoC '26 if assigned.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions