Skip to content
This repository was archived by the owner on Oct 14, 2025. It is now read-only.

Conversation

henrytwo
Copy link

@henrytwo henrytwo commented Jan 5, 2023

Fixed bug where global variable in validateGroup was mutated after every call to the middleware function, causing a "memory leak" in a sense.

The bug was a result of the admin role being pushed to the group array every time an endpoint using that particular validator was invoked. The fix for this was to move these operations outside the closure, since they really only need to be executed once.

This bug isn't particularly dangerous on face level, but if someone were to spam the API then the server could potentially start running out of memory.

Reproducing the bug from an account without proper authorization to use an endpoint:

$ curl 'https://root.treehacks.com/api/judges'  ...
Unauthorized; user is not in group admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin.%                                                                                                                                   
$ curl 'https://root.treehacks.com/api/judges'  ...
Unauthorized; user is not in group admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin.%                                                                                                                              

Notice how the number of admins gets a bit longer? That doesn't look right 🧐

Another cool example:

$ curl 'https://root.treehacks.com/api/review/stats'  ...
Unauthorized; user is not in group reviewer,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin.%

Yeah, that's a lot of admins 😅

…every call to the middleware function, causing a "memory leak" in a sense.

The bug was a result of the admin role being pushed to the `group` array every time an endpoint using that particular validator was invoked. The fix for this was to move these operations outside the closure, since they really only need to be executed once.

This bug isn't particularly dangerous on face level, but if someone were to spam the API then the server could potentially start running out of memory.

Reproducing the bug from an account without proper authorization to use an endpoint:
```
$ curl 'https://root.treehacks.com/api/judges'  ...
Unauthorized; user is not in group admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin.%
$ curl 'https://root.treehacks.com/api/judges'  ...
Unauthorized; user is not in group admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin,admin.%
```
Notice how the number of `admin`s gets a bit longer? That doesn't look right 🧐
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant