laststance / laststance/gitbox

Error message reflection in /login?error=...

Open Beginner friendly
#184 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

P2-medium security
Dominant language
TypeScript
Stars
5
Forks
2
Avg merge
6h 9m
Merged PRs (30d)
2

Description

Summary

Raw rateLimitResult.error and oauthError.message are reflected into redirect URLs.

Source

P2 follow-up from /ship adversarial review of PR #176 (silent GitHub token refresh).

Details

route.ts:80,124 reflect rateLimitResult.error and oauthError.message via encodeURIComponent to a redirect URL.

Fix

Emit fixed error codes only (rate_limited, oauth_failed); keep messages in server logs / Sentry.

Acceptance

  • No raw error messages in /login?error=...
  • Stable error codes documented
  • Tests assert only canonical codes appear in URLs

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in route.ts at lines 80 and 124, where the rate-limit and OAuth errors are reflected into the redirect URL. Trace the /login?error=... flow, then add or update tests so URLs contain only the canonical codes and document those codes as part of the acceptance criteria.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.