Skip to content

Design flaw introduced by Hard-coded number of salts #11

@petruki

Description

@petruki

Describe the bug
Component API keys use a non-descriptive number of salts to generate hash:

componentSchema.methods.generateApiKey = async function () {
    const component = this;

    const apiKey = randomUUID();
    const hash = await bcryptjs.hash(apiKey, 8);
    component.apihash = hash;
    await component.save();
    
    return apiKey;
};

Expected behavior
Replace by descriptive constant

Additional context
https://cwe.mitre.org/data/definitions/547.html

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingsecurityVulnerability detected

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions