[Bug]: Event: Any day submission acceptance with no solution

[SanariSan]

What happened?

Briefly described in my posts on twitter, but will elaborate here.

Yesterday I could peek any locked day by opening https://typehero.dev/challenge/day-X/submissions (only with /submissions).
There was only test data, description section locked as it has to be.
After that I looked at submission req and played with it a bit, so I can complete any challenge.

As I can see recent #1234 fixed upcoming tests peeking, and possibly submissions for locked days, but actually there's still a loophole.

Submission is not connected to challenge.slug, so I can clip any viable slug to pass that check, then persist submission.

Fix would be to probably hold slug in submission or having a slug:submission map for verifying before saving.

What browsers are you seeing the problem on?

All

Relevant log output

No response

[bautistaaa]

Thank you for this.

Will work on solution asap. We have plans to also do server side validation on the code being submitted which will help tremendously here

[bautistaaa]

i removed the script so others wont easy steal it. i think next time its best to keep the sensitive ones. i think we have this one (see image) but i honestly havent tested it haha

[SanariSan]

i removed the script so others wont easy steal it. i think next time its best to keep the sensitive ones. i think we have this one (see image) but i honestly havent tested it haha

I was considering this option, but got assured it's fine to just open an issue

[zaCKoZAck0]

i removed the script so others wont easy steal it. i think next time its best to keep the sensitive ones. i think we have this one (see image) but i honestly havent tested it haha

I was considering this option, but got assured it's fine to just open an issue

MB

[Hacksore]

Work for server side typescript evaluation exists in a PoC here.

https://github.com/Hacksore/typecheck-service/tree/feat/worker-cf

I’ve not touched it in some time as there are many things that need to be addressed.

if anyone is willing to help bring this to a better state feel free.

🫡

[bautistaaa]

i think its okay for now but im kinda unsure how to handle this slug loophole