Fix Slack token extraction failing on newer LevelDB fragmentation markers#34
Merged
Fix Slack token extraction failing on newer LevelDB fragmentation markers#34
Conversation
…kers The LDB parser hardcoded one fragmentation marker pattern (0x19 0x0d 0xf0) but newer compacted files use different prefixes (e.g. 0x15 0x0b 0xf0). When the 4th byte happened to be a valid hex char, it leaked into the reconstructed token, corrupting it and causing auth failures.
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix
invalid_autherrors caused by corrupted token reconstruction from newer LevelDB.ldbfiles. The parser hardcoded one fragmentation marker pattern (0x19 0x0d 0xf0) but newer compacted files use different prefixes (e.g.0x15 0x0b 0xf0). When an unrecognized marker's 4th byte happened to be a valid hex character (e.g.0x43=C), it leaked into the reconstructed token, corrupting it silently.Changes
token-extractor.tsextractTokenFromBuffer()to match any 4-byte sequence where the 3rd byte is0xf0, instead of requiring exact0x19 0x0dprefix bytes. This handles both known marker variants and future ones.token-extractor.test.ts[19 0d f0 5e]), new marker with hex-valid 4th byte ([15 0b f0 43]), and new marker with non-hex 4th byte ([15 0b f0 58]).Verified
bun test— 12 pass, 0 fail.bun typecheck— clean.bun lint— clean, 166 files checked.Summary by cubic
Fixes invalid_auth errors when parsing Slack tokens from LevelDB by handling newer fragmentation markers. The parser now treats any 4-byte marker with 0xf0 as the third byte as a hyphen, preventing stray bytes from corrupting tokens.
Written for commit d3be0b0. Summary will update on new commits.