Automattic / Automattic/simplenote-electron
Notes with valid Collaborator email is automatically restored from Trash and still holding non Simplenote accounts in Collaborators list
- Dominant language
- TypeScript
- Stars
- 5.3k
- Forks
- 588
- Avg merge
- 9h 45m
- Merged PRs (30d)
- 4
Description
It’s not possible to send a note to `Trash` if it has a valid account in Collaborators list. The note leaves `All Notes` for a second but comes back without any valid account in Collaborators list.
If the original Collaborators list contains a mix of valid and not valid accounts, after trying to send the note to `Trash`, the remaining list will still hold all the invalid Simplenote users letting a possible attacker identify valid accounts and take advantage in brute force or social engineering attacks.
It happens the same way in Simplenote Android 2.19
### Expected
Notes shouldn't be automatically restored and the Collaborators list should be empty if it gets intentionally restored from `Trash` at some point.
### Observed
Notes are being automatically restored moments after being sent to `Trash` and still holding in Collaborators list emails that are not associated with a Simplenote account.
### Reproduced
1. Visit develop.simplenote.com
2. Create a note
3. Include a mix of valid and invalid users as Collaborators
4. Send the note to `Trash`
* Notice that the note will leave `All Notes` and come back shortly
5. Check the Collaborators list
* The invalid account was kept in list
Uploading simplenote_web_collaborate.mov…
### Where did you see the bug
- OS: macOS
- OS version: 11.5.2
- Browser: Safari
- Browser version: 14.1.2
- Simplenote app version: 2.18.0-beta1
Contributor guide
Research direction
Reproduce the behavior at develop.simplenote.com using the listed collaborator and Trash steps, then trace the note restoration and collaborator-list handling from the application entry points. Done means a note stays in Trash and an intentionally restored note has no invalid collaborator emails, including when the list mixes valid and invalid accounts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- electron, typescript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100