First Flight #16: Mafia Takedown

Summary

Some very important values that are used as permission role names and also core Module and Policy names are hardcoded whenever used as opposed to being constants and defined just the once.

Vulnerability Details

This increases the chance of typos in the codebase and logic errors as a result.

Impact

None, but had to manually check all the usages to make sure they were ok.

Tools Used

My eyes and a search function within my IDE.

Recommendations

Put all these values into CONSTANTS and use the constant instead. An exmaple of the hardcoded keycodes is below.