Developer Finds Hidden Assumptions in Loan Calculators After Building His Own

·1 views

A software developer built a personal loan calculator after finding that existing tools assumed users calculate once and never return, which does not reflect how real borrowing decisions unfold over days across multiple lenders. While adding extra-payment handling, he initially modeled prepayments using the convention of holding the monthly payment constant and shortening the loan term. Running the same inputs under an alternative convention — holding the maturity date and reducing the monthly payment instead — produced results his data model had no fields to capture. Further investigation revealed his prepayment fee formula was also hardcoded to a flat-rate calculation, whereas a term-prorated formula on identical inputs produced a fee nearly three times smaller. The exercise showed that unexamined assumptions inherited from reference tools can silently shape both the arithmetic and the conclusions a calculator presents to users.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

JWT 'kid' Parameter Flaw Enables SQL Injection and Path Traversal Attacks

A security vulnerability in how servers process the JSON Web Token 'kid' header parameter allows attackers to manipulate key selection without breaking cryptography. Because the RFC defines no required format or character restrictions for 'kid', most libraries pass the raw value directly to database queries or file reads without sanitization. In the SQL injection variant, an attacker injects a UNION payload to make the server use an attacker-chosen HMAC key, then re-signs a forged token that passes verification. In the path traversal variant, injecting a sequence like '../../../../dev/null' causes the server to read an empty file, letting the attacker sign tokens with a predictable null-byte key. The vulnerability is rated CVSS 7.5 High, requires no prior authentication, and fully compromises authentication integrity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Major WebSocket Frameworks Leave Origin Validation Off by Default, Enabling CSWSH

Cross-Site WebSocket Hijacking (CSWSH) exploits a gap in the Same-Origin Policy, allowing attackers to establish a persistent, bidirectional, authenticated channel by tricking a logged-in user's browser into initiating a WebSocket connection to a malicious page. Unlike standard HTTP requests, the WebSocket upgrade bypasses CORS preflight entirely, sending session cookies cross-origin without restriction — a deliberate protocol design dating back to RFC 6455. Four of the five dominant WebSocket frameworks ship with Origin validation disabled by default, leaving applications exposed unless developers explicitly enable the check. Real-world consequences have been severe: CVE-2020-25095 enabled unauthentiated remote code execution on LogRhythm, CVE-2023-0957 led to full Gitpod account takeover, and CVE-2024-51775 exposed Apache Zeppelin data to unauthenticated remote attackers. Security researchers trace the recurring vulnerability to an engineering culture where WebSocket endpoints are added to cookie-authenticated apps without applying the same CSRF-era protections already in place for HTTP routes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds Rust-based version bump tool claiming 10,000x speed over Python

A developer rebuilt the popular bump-my-version CLI tool in Rust after finding the Python original took a full second to increment a single version number. The new tool, called bump2version 0.2.0, automates updating version strings across multiple files such as Cargo.toml, package.json, and CHANGELOG.md in a single operation. It uses pure-Rust git integration via the gix library, avoiding subprocess calls entirely, and enforces memory safety with no unsafe code. Beyond a standalone CLI, the project exposes bindings for Python and Node.js, making the same Rust core accessible across three ecosystems. The developer acknowledged receiving outside assistance with parts of the system design during the project.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Passwordless Auth Exposes Tokens in Logs, Headers, and Email Forwarding Chains

Security researchers have highlighted how passwordless authentication methods such as magic links and TOTP, despite being designed to reduce phishing risk, introduce multiple new attack surfaces. Magic link tokens embedded in GET request URLs are routinely captured in server access logs from nginx, Apache, and CDN proxies, where they remain readable until log rotation. A critical vulnerability, CVE-2026-39912 (CVSS 9.1), exposed over 7,000 instances of V2Board by returning auth tokens directly in HTTP response bodies without requiring authentication. Browser Referer headers can leak tokens to third-party analytics platforms, while email security gateways may silently consume single-use tokens during URL prefetching scans. Additionally, attackers who briefly gain inbox access can plant silent forwarding rules that continue delivering future magic link tokens even after a password reset, leaving no failed login alerts for the application to detect.

0 comments Read more at DEV Community