You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I've encountered a bug in the web application that you can create new finished races to show up in dashboard with same snippet id by posting to 'https://code-racer-eight.vercel.app/race/practice' directly. This allows users to create multiple races by using the same snippet id.
Also system only checks if the cpm is less than or equal 10k and accuracy is less than or equal to 100. Other than that there is no validation to check the cpm and accuracy of races that have been posted. Any post using same headers allows users to create races with fake results. Steps i followed to be able to post any cpm and accuracy ratings:
Copy the valid request from the network panel of devtools by playing a random race.
Find the snippet id by refreshing the page after the snippet is loaded. (It is in the last script tag which contains self.__next_f)
Send request after changing the snippetId value to the new snippet id.
(optional) What browsers are you seeing the problem on?
No response
Code of Conduct
I agree to follow this project's Code of Conduct
The text was updated successfully, but these errors were encountered:
Description
I've encountered a bug in the web application that you can create new finished races to show up in dashboard with same snippet id by posting to 'https://code-racer-eight.vercel.app/race/practice' directly. This allows users to create multiple races by using the same snippet id.
Also system only checks if the cpm is less than or equal 10k and accuracy is less than or equal to 100. Other than that there is no validation to check the cpm and accuracy of races that have been posted. Any post using same headers allows users to create races with fake results. Steps i followed to be able to post any cpm and accuracy ratings:
(optional) What browsers are you seeing the problem on?
No response
Code of Conduct
The text was updated successfully, but these errors were encountered: