russell@unturf.com
60b0999acd
wekan-0003: MOAD-0001 wekanCreator.js member dedup uses Array.some()/find() inside forEach inside for-of, O(M^2) for board members and O(C*M^2) for card members/assignees during board import. Fix: Set-based dedup O(1). 58.8x op-count reduction (board), 5.6x (cards). 4/4 PASS. rocketchat-0003: MOAD-0001 endDirectCall() calls call.users.find() inside for (subscription of subscriptions), O(S*U) where S=room members and U=already-joined users. Fix: build Set before loop for O(1) lookup. 100x speedup modeled at S=10000, J=100. 5/5 PASS. rocketchat-0004: MOAD-0004 CWE-312 oauth2-server/model.ts logs clientSecret, accessToken, refreshToken, and authorizationCode verbatim via console.log when debug=true. Fix: replace credential values with [REDACTED] sentinel. Wekan MOAD-0002/0003/0004/0005 CLEAN (Meteor 3.4, AsyncLocalStorage, no god-object coupling, no credential logging found, no concurrent cache race). Rocket.Chat MOAD-0002/0003/0005 CLEAN (Meteor 3.3.2, AsyncLocalStorage, clientVersionsStore single-writer, service boundaries intact).
61 lines
2.9 KiB
Diff
61 lines
2.9 KiB
Diff
--- a/apps/meteor/server/oauth2-server/model.ts
|
|
+++ b/apps/meteor/server/oauth2-server/model.ts
|
|
@@ -39,7 +39,7 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {
|
|
|
|
async getAccessToken(accessToken: string): Promise<Token | Falsey> {
|
|
if (this.debug === true) {
|
|
- console.log('[OAuth2Server]', 'in getAccessToken (bearerToken:', accessToken, ')');
|
|
+ console.log('[OAuth2Server]', 'in getAccessToken (bearerToken: [REDACTED])');
|
|
}
|
|
|
|
@@ -67,7 +67,7 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {
|
|
async getClient(clientId: string, clientSecret?: string): Promise<Client | Falsey> {
|
|
if (this.debug === true) {
|
|
- console.log('[OAuth2Server]', 'in getClient (clientId:', clientId, ', clientSecret:', clientSecret, ')');
|
|
+ console.log('[OAuth2Server]', 'in getClient (clientId:', clientId, ', clientSecret: [REDACTED])');
|
|
}
|
|
|
|
@@ -92,7 +92,7 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {
|
|
async getAuthorizationCode(authorizationCode: string): Promise<AuthorizationCode | Falsey> {
|
|
if (this.debug === true) {
|
|
- console.log('[OAuth2Server]', `in getAuthorizationCode (authCode: ${authorizationCode})`);
|
|
+ console.log('[OAuth2Server]', 'in getAuthorizationCode (authCode: [REDACTED])');
|
|
}
|
|
|
|
@@ -167,11 +167,11 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {
|
|
async saveToken(token: Token, client: Client, user: User): Promise<Token | Falsey> {
|
|
if (this.debug === true) {
|
|
console.log(
|
|
'[OAuth2Server]',
|
|
'in saveToken (token:',
|
|
- token.accessToken,
|
|
+ '[REDACTED]',
|
|
', refreshToken:',
|
|
- token.refreshToken,
|
|
+ '[REDACTED]',
|
|
', clientId:',
|
|
client.id,
|
|
', user:',
|
|
@@ -211,7 +211,7 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {
|
|
async getRefreshToken(refreshToken: string): Promise<RefreshToken | Falsey> {
|
|
if (this.debug === true) {
|
|
- console.log('[OAuth2Server]', `in getRefreshToken (refreshToken: ${refreshToken})`);
|
|
+ console.log('[OAuth2Server]', 'in getRefreshToken (refreshToken: [REDACTED])');
|
|
}
|
|
|
|
@@ -249,7 +249,7 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {
|
|
async revokeToken(token: RefreshToken | Token): Promise<boolean> {
|
|
if (this.debug === true) {
|
|
- console.log('[OAuth2Server]', `in revokeToken (token: ${token.accessToken})`);
|
|
+ console.log('[OAuth2Server]', 'in revokeToken (token: [REDACTED])');
|
|
}
|
|
|
|
@@ -268,7 +268,7 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {
|
|
async revokeAuthorizationCode(code: AuthorizationCode): Promise<boolean> {
|
|
if (this.debug === true) {
|
|
- console.log('[OAuth2Server]', `in revokeAuthorizationCode (code: ${code.authorizationCode})`);
|
|
+ console.log('[OAuth2Server]', 'in revokeAuthorizationCode (code: [REDACTED])');
|
|
}
|
|
await OAuthAuthCodes.deleteOne({ authCode: code.authorizationCode });
|
|
return true;
|
|
}
|