cds-snc / cds-snc/platform-forms-client

Handle non compliant hCaptcha API response to prevent submissions from being blocked

Open
#6,242 0 comments 0 reactions 0 assignees View on GitHub
:vertical_traffic_light: Minor development good first issue incident
Dominant language
TypeScript
Stars
46
Forks
16
Avg merge
1d 9h
Merged PRs (30d)
91

Description

In a response to an [incident that happened on October 15th](https://docs.google.com/document/d/1_m741vCu3nieVoJFrkVyGqmKTx4aEEvLoA2L_p0MXaI) we should make sure that hCaptcha API responses are valid before deciding to prevent a user from submitting a response.

For example, with this specific piece of code https://github.com/cds-snc/platform-forms-client/blob/f181759e427c227558de4b589c085aa4f823eac8/lib/validation/hCaptcha.ts#L73 the `error-codes` property is optional (according to hCaptcha's documentation) and when it exist it should provide us an array of errors codes but the incident showed that an empty array was received. In this case we should send a warning log to our development team but allow the submission to go through.

Contributor guide

Open the contributing guide

Research direction

Start in lib/validation/hCaptcha.ts at the linked code around line 73 and review how the hCaptcha response and optional error-codes value are handled. Confirm the empty-array case is logged as a warning without blocking submission, while invalid responses still receive the intended handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.