Skip to content
This repository has been archived by the owner on Jan 14, 2020. It is now read-only.

🐃 No code to check that review.rating is actually between 1-5 #535

Open
DanielVF opened this issue Sep 24, 2018 · 2 comments
Open

🐃 No code to check that review.rating is actually between 1-5 #535

DanielVF opened this issue Sep 24, 2018 · 2 comments
Labels
bug Something isn't working as intended origin.js security

Comments

@DanielVF
Copy link
Collaborator

We currently don't check that a review rating coming from IPFS is between 1-5. This would allow an evil reviewer to mess up any future aggregated review rating score for someone by submitting an out of range review.

@DanielVF DanielVF added bug Something isn't working as intended origin.js security labels Sep 24, 2018
@franckc
Copy link

franckc commented Sep 24, 2018

Good catch. Seems we should add some checks to cap rating between 1-5 in origin-js when writing and reading review data from IPFS.

BTW, what are we deciding on rating value. Is it an integer, one of [1,2,3,4,5] or is it a float between 1.0 and 5.0 ? I'd favor using integer for now to keep things simple. Any objections ?

@DanielVF
Copy link
Collaborator Author

I'm good with changing it to an integer.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Something isn't working as intended origin.js security
Projects
None yet
Development

No branches or pull requests

2 participants