NodeBB / NodeBB/nodebb-plugin-sso-oauth2-multiple
Using setUserField might lead to an unbounded number of keys
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 14
- Forks
- 9
- Avg merge
- 1m
- Merged PRs (30d)
- 7
Description
Hi Julian,
as I was debugging my changes for https://github.com/NodeBB/nodebb-plugin-sso-oauth2-multiple/pull/125
I've noticed that this line:
await db.setObjectField(`${payload.name}Id:uid`, payload.oAuthid, uid);
( https://github.com/NodeBB/nodebb-plugin-sso-oauth2-multiple/blob/main/library.js#L251 ) will add a key to a single mongo document for each user.
I'm afraid that when there will be hundreds of thousands users, things might be slow or even break. Is my concern valid, or is it handled somewhere?
Thanks,
Tomas
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at library.js line 251 and trace how db.setObjectField stores the OAuth mapping in MongoDB. Check whether each user creates a distinct field in one document and whether NodeBB or MongoDB imposes relevant limits. Done means documenting whether the concern is valid and, if so, identifying the required scope of a mitigation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, mongodb
- Domain
- authentication, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100