decentraland / comms-gatekeeper / 28595842955

85%

main: 85%

Build Type

Pull #276

github

Committed by LautaroPetaccio

Commit Message

refactor: revert ban-status disclosure trim; address review comments

- Revert the /users/:address/bans response trim — exposing the full ban record
  is acceptable per product, so the unauthenticated endpoint returns the full
  ban again (the advisory-lock concurrent-ban test is kept).
- Extract the sceneId -> place resolution into a shared resolvePlaceBySceneId
  helper (src/logic/scene-place.ts), used by cast, comms-scene-handler and
  scene-bans, so the room<->place security invariant lives in one place.
- Centralize the empty-ingress guard behind activeIngressCondition() in
  scene-stream-access-manager.
- Add encodeURIComponent to the remaining user-influenced URL segments in
  lands/component.ts and worlds.ts (defense-in-depth).

Pull Request Pull Request #276: fix: address security audit findings (access control, disclosure, hardening)

Coverage Stats

1120 of 1438 branches covered (77.89%)

Branch coverage included in aggregate %.

83 of 95 new or added lines in 20 files covered. (87.37%)

4 existing lines in 1 file now uncovered.

3101 of 3500 relevant lines covered (88.6%)

74.95 hits per line