-
Notifications
You must be signed in to change notification settings - Fork 18
Switch mailers to SES #72
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
|
||
| def send_step_up_email_code | ||
| login_code = current_identity.v2_login_codes.create! | ||
| IdentityMailer.step_up_code(current_identity, login_code).deliver_later | ||
| IdentityMailer.v2_login_code(current_identity, login_code).deliver_later | ||
| end | ||
|
|
||
| # Prevent open redirect attacks - only allow internal paths |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Bug: The IdentityMailer.v2_login_code call in step_up_controller.rb passes two arguments, but the mailer method now expects only one.
Severity: CRITICAL | Confidence: High
🔍 Detailed Analysis
The IdentityMailer.v2_login_code method is called with two arguments (current_identity, login_code) in step_up_controller.rb's send_step_up_email_code method. However, the updated mailer method now expects only one argument (login_code). This mismatch will cause an ArgumentError: wrong number of arguments (given 2, expected 1) when users attempt to use email-based verification in the step-up authentication flow, leading to a critical application crash.
💡 Suggested Fix
Update the call to IdentityMailer.v2_login_code in step_up_controller.rb to pass only the login_code argument. The identity can be accessed via login_code.identity within the mailer.
🤖 Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: app/controllers/step_up_controller.rb#L109-L115
Potential issue: The `IdentityMailer.v2_login_code` method is called with two arguments
(`current_identity`, `login_code`) in `step_up_controller.rb`'s
`send_step_up_email_code` method. However, the updated mailer method now expects only
one argument (`login_code`). This mismatch will cause an `ArgumentError: wrong number of
arguments (given 2, expected 1)` when users attempt to use email-based verification in
the step-up authentication flow, leading to a critical application crash.
Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 5637289
loops delenda est......
until zach decides it's loops again