laststance / laststance/gitbox
Error message reflection in /login?error=...
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 5
- Forks
- 2
- Avg merge
- 6h 9m
- Merged PRs (30d)
- 2
Description
Summary
Raw rateLimitResult.error and oauthError.message are reflected into redirect URLs.
Source
P2 follow-up from /ship adversarial review of PR #176 (silent GitHub token refresh).
Details
route.ts:80,124 reflect rateLimitResult.error and oauthError.message via encodeURIComponent to a redirect URL.
Fix
Emit fixed error codes only (rate_limited, oauth_failed); keep messages in server logs / Sentry.
Acceptance
- No raw error messages in
/login?error=... - Stable error codes documented
- Tests assert only canonical codes appear in URLs
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in route.ts at lines 80 and 124, where the rate-limit and OAuth errors are reflected into the redirect URL. Trace the /login?error=... flow, then add or update tests so URLs contain only the canonical codes and document those codes as part of the acceptance criteria.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100