nullterminated / ponder Goto Github PK

ERTwoFactorAuthenticationProcessor doesn't hash on invalid user name opening the possibility of enumeration attacks. Interesting article on the subject.

https://paragonie.com/blog/2016/01/on-design-and-implementation-stealth-backdoor-for-web-applications

AWS frequently sends more than one notification message for the same awsfeedbackid. This results in a validation exception on save. Not a big deal unless you are getting an error email every time it happens...

A simple StringUtils.left(...) would be helpful.

When using a webbug to capture date read for mail messages, the ERCoreBL framework should also capture the email user agent information. Probably should move this into a separate table which captures every date read instead of just the most recent one as well.

Fixable with

update public.sesnotification t1
set mailmessageid = t2.id
from public.ercmailmessage t2
where t2.messageid = t1.awsmessageid and t1.mailmessageid is null

but it shouldn't be missing these.

It appears the recipient related to these messages end up with a null dateLastSent on the ERCMailAddress too. The sql to fix this is probably more complicated.