Reviewed 12 Sept, at 663c738 — open the Check Run
Mediumsrc/auth.ts:23correctness
Simplified `verify` function uses strict equality instead of constant-time comparison.
If the signatures are not exactly equal due to encoding or other factors, this will incorrectly return false positives.
Suggested fix: Use timingSafeEqual for constant-time comparison.
Not checked
Mediumsrc/auth.ts:23security
Simplified `verify` function uses strict equality instead of constant-time comparison.
If the signatures are not exactly equal due to encoding or other factors, this will incorrectly return false positives.
Not checked
Mediumsrc/users.ts:17security
`hasActiveSession` function relies on `isExpired` from `auth.ts`.
If the `isExpired` function is not correctly implemented, this could lead to incorrect session validation.
Not checked
Highsrc/users.ts:18security
SQL query constructed with string interpolation.
This is vulnerable to SQL injection attacks if the `name` parameter is not properly sanitized.
Not checked
Below the posting bar, not confirmed by the second look, or already commented on by an earlier review.
Every kept finding was posted.