Grant Cox comments

Results 5 comments of


                                            Grant Cox

`MemoryVFS` should avoid creating `Proxy` objects in `makeDataArray`

> But are you really using MemoryVFS for anything real where you need that performance? Ha, that's a great question! Our project involves an existing shared-business-logic module that is used...

`Confirmable` "change email" vulnerability - race condition permits user to confirm email address they have no access to

> [@grantcox](https://github.com/grantcox) Have you created a CVE for this? https://cveform.mitre.org/ I had not, but I have just submitted that now, thank you for the reminder. I will update here when...

`Confirmable` "change email" vulnerability - race condition permits user to confirm email address they have no access to

No, not yet, only the auto-reply that they'll investigate it. It is "CVE Request 1905238" for whatever that is worth. I haven't submitted a CVE before, but looking online it...

`Confirmable` "change email" vulnerability - race condition permits user to confirm email address they have no access to

FWIW I sent a status request to `[email protected]` on Sept 6, a month after the initial submission, and have received no response to that either. 🤷

Fix race condition vulnerability, by ensuring the `unconfirmed_email` is always saved

Thank you for the feedback @runephilosof-abtion , your changes were very helpful and I've merged them all now