cds-snc / cds-snc/platform-forms-client
Handle non compliant hCaptcha API response to prevent submissions from being blocked
- Dominant language
- TypeScript
- Stars
- 46
- Forks
- 16
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 91
Description
In a response to an [incident that happened on October 15th](https://docs.google.com/document/d/1_m741vCu3nieVoJFrkVyGqmKTx4aEEvLoA2L_p0MXaI) we should make sure that hCaptcha API responses are valid before deciding to prevent a user from submitting a response.
For example, with this specific piece of code https://github.com/cds-snc/platform-forms-client/blob/f181759e427c227558de4b589c085aa4f823eac8/lib/validation/hCaptcha.ts#L73 the `error-codes` property is optional (according to hCaptcha's documentation) and when it exist it should provide us an array of errors codes but the incident showed that an empty array was received. In this case we should send a warning log to our development team but allow the submission to go through.
Contributor guide
Research direction
Start in lib/validation/hCaptcha.ts at the linked code around line 73 and review how the hCaptcha response and optional error-codes value are handled. Confirm the empty-array case is logged as a warning without blocking submission, while invalid responses still receive the intended handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100