Automattic / Automattic/simplenote-electron

Notes with valid Collaborator email is automatically restored from Trash and still holding non Simplenote accounts in Collaborators list

Open
#2,992 0 comments 0 reactions 0 assignees View on GitHub
[feature] collaborate bug
Dominant language
TypeScript
Stars
5.3k
Forks
588
Avg merge
9h 45m
Merged PRs (30d)
4

Description

It’s not possible to send a note to `Trash` if it has a valid account in Collaborators list. The note leaves `All Notes` for a second but comes back without any valid account in Collaborators list.
If the original Collaborators list contains a mix of valid and not valid accounts, after trying to send the note to `Trash`, the remaining list will still hold all the invalid Simplenote users letting a possible attacker identify valid accounts and take advantage in brute force or social engineering attacks.

It happens the same way in Simplenote Android 2.19

### Expected
Notes shouldn't be automatically restored and the Collaborators list should be empty if it gets intentionally restored from `Trash` at some point.

### Observed
Notes are being automatically restored moments after being sent to `Trash` and still holding in Collaborators list emails that are not associated with a Simplenote account.

### Reproduced
1. Visit develop.simplenote.com
2. Create a note
3. Include a mix of valid and invalid users as Collaborators
4. Send the note to `Trash`
* Notice that the note will leave `All Notes` and come back shortly
5. Check the Collaborators list
* The invalid account was kept in list

Uploading simplenote_web_collaborate.mov…

### Where did you see the bug

- OS: macOS
- OS version: 11.5.2
- Browser: Safari
- Browser version: 14.1.2
- Simplenote app version: 2.18.0-beta1

Contributor guide

Open the contributing guide

Research direction

Reproduce the behavior at develop.simplenote.com using the listed collaborator and Trash steps, then trace the note restoration and collaborator-list handling from the application entry points. Done means a note stays in Trash and an intentionally restored note has no invalid collaborator emails, including when the list mixes valid and invalid accounts.

Written by the indexing model from the issue text.

Assessment

Tech stack
electron, typescript
Domain
frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.