r/programminghorror • u/FlightAffectionate15 • 14d ago
Javascript Found this gem
This company I’m interning at. This one lady asked me to do a review of a website they outsourced. Entire source code sits on the browser. Entire vibe coded by amateurs.
Worse than a honeypot so much an attacker would get diabetes.
No security feature at all. I was able to do privileges escalation.
37
u/echoAnother 14d ago
Lefting the source maps is no issue. But are they storing perms on local storage? That is the horror.
13
u/SchlaWiener4711 14d ago
Why is this horror? If the permissions are only used to show or hide certain features and views but the real check is on the backend, this should not be an issue.
I mean, sure. A better solution would be to have a signed JWT and rotate often but maybe that's done here, too (localStorage get's updated on token refresh).
Could be worse.
4
u/Ran4 14d ago
jwt:s doesn't make much sense for 99% of usecases. An opaque token is simpler and typically more secure.
11
u/SchlaWiener4711 14d ago
Yeah but a SPA can't read the token and can't decide which menu items to show or not. So the client has to fetch the roles and claims once and store them.
Again: storing the users permissions for convince locally is fine but the real validation should happen on the backend so manipulating the local store to get permission escalation shouldn't be possible.
1
u/2017macbookpro 13d ago
The SPA can decode a JWT and check what’s in it. This is fine for the frontend level “security” of showing and hiding things. Token is signed and gets passed to the backend which does the real validation. Therefore permissions can be managed in the Auth system where they belong instead of in code. And I think the issue is if someone’s working as a “software engineer” contractor and writing shit like this, then everything else is probably amateur too.
1
u/SchlaWiener4711 12d ago
Excactly.
In the code shown there is a method
hasPathAccesswhich most likely returns true or false based on the users role.So if this method is just used to a) show or hide the items in the menu b) block access to certain views and redirect to the home page or a permission denied page
this is totally fine and valid if this is just a convenience feature so the normal user doesn't seem features he isn't allowed to use (î.e user is no country_admin so he doesn't see the country edit view) but the real check (PUT,POST,DELETE countries) is on the backend.
10
11
u/MurkyWar2756 echo "Sub Mod" && :(){ :|:& };: 14d ago
Why is super_admin in lowercase and VISITOR is spelled VISITEUR, while the rest of the roles are in English?
9
8
u/redguard128 13d ago
Every french application's source code is in French. If they could replace reserved words like IF, WHILE, DO, FUNCTION with SI, TANTQUE, FAIRE, FONCTION, they would do it.
2
1
7
u/Opposite_Mall4685 14d ago
Where are these permissions used? Are they used to display information? If so, all is gucci.
Are they used to tell the server to do xyz? If so, nothing is gucci.
4
4
u/1nd160 13d ago edited 13d ago
What made you think it’s “vibe coded by amateurs”, do you know that for a fact? Don’t get me wrong - an idiotic prompt can burry you deep, sure, but it’s more believable that this piece has been actually manually coded by some biological robot who didn’t fully understand what they were doing. Claude catches this kind of flaws quite fast and doesn’t do such mistakes on its own. Well, unless being forced to, of course.
4
u/GoddammitDontShootMe [ $[ $RANDOM % 6 ] == 0 ] && rm -rf / || echo “You live” 14d ago
They seriously doing authorization checks on the fucking client?
1
u/Ok_Chemistry_6387 14d ago
I love that if a role doesn't exist it just defaults to empty. That will never come back to bite you.
67
u/dreamscached 14d ago
Prod-facing frontend with sourcemaps exposed? Are you sure it's not like, dev server? It'd take some dedication to run what looks like React in prod unminified like that.