Found during a security audit.
Where: screen.js:414-445, ROOM_KEY_ALPHABET
Issue: 6-char key over a 30-symbol alphabet (~7.3×10⁸ combinations) is brute-forceable given enough time; the code's own comment relies on server-side rate-capping (in the feedBack core repo, not this plugin) to make scanning impractical.
Impact: Design tradeoff, not a code bug in this repo — filing to make sure the server-side rate-capping this plugin's design depends on actually exists and is tracked.
Suggested fix: Verify/implement per-IP or per-key connection rate limiting on feedBack core's /ws/sync/{room_key} endpoint.
Found during a security audit.
Where:
screen.js:414-445,ROOM_KEY_ALPHABETIssue: 6-char key over a 30-symbol alphabet (~7.3×10⁸ combinations) is brute-forceable given enough time; the code's own comment relies on server-side rate-capping (in the
feedBackcore repo, not this plugin) to make scanning impractical.Impact: Design tradeoff, not a code bug in this repo — filing to make sure the server-side rate-capping this plugin's design depends on actually exists and is tracked.
Suggested fix: Verify/implement per-IP or per-key connection rate limiting on
feedBackcore's/ws/sync/{room_key}endpoint.