Bug Reports

Event properties set to 'always send' are changed to 'sometimes send' after merging to "main" branch. It's an issue as it publishes the taxonomy to Snowplow with the wrong settings.

Summary: The login page on evo.app accepts a null (empty) password, allowing users to log in without providing any credentials. This issue poses a significant security risk, as it could enable unauthorized access to user accounts. Steps to Reproduce: Navigate to the evo.app login page. Enter a valid username or email address. Leave the password field empty (null). Click on the "Login" button. Expected Result: The system should reject the login attempt and display an error message indicating that the password field cannot be empty. Actual Result: The system accepts the login attempt and grants access to the user's account without requiring a password. Impact: This bug allows anyone with access to a valid username or email address to log in to the corresponding account without needing to know the password, potentially leading to unauthorized access and data breaches. Additional Information: This issue could indicate a problem with the server-side authentication logic, where the password validation is either missing or improperly handled. Consider reviewing the authentication process to ensure that passwords are correctly validated and that null passwords are explicitly rejected. Suggested Fix: Implement proper validation on the password field to ensure that it cannot be empty before proceeding with the login process. Additionally, review the entire authentication flow to ensure that similar issues are not present elsewhere. Name = Sagar Rawat email = cybersagar2214@gmail.com , dobrae12345@gmail.com

I was debugging a problem where we had events marked as correctly sent in the visual debugger as well as in the console. As you can see on the screenshots, I get a validation for "Checkout step started". However, the event was never correctly sent via the Snowplow Interface because of an timing issue, where the Interface wasn't initialized fast enough before the first event. The code in Avo.ts first logs the event as sent correctly, before actually trying to send it via trackSelfDescribingEvent . This should be handled differently, so we can be sure, that a event was actually successful.

When using the visual debugger our devs noticed that "Property value rules" for properties are not checked correctly: When sending a value which is not in the allow list the debugger would show a green checkmark instead of flagging an error with the event. This causes to send events to production with wrong values and loosing data in the end due to failing events.

I tried to export our Avo spec as a JSON schema. However, clicking the "Export JSON Schema" button hangs the browser application, and the only thing I can do is to close the tab.

Current workaround: Add the property you want to pin directly to the event, and apply the pinned value to that one.

We've got a lot of "Navigated To" events, so when I go to search for Navigated To LaneMakers, I don't get any options and I can't link the event, nor can I scroll through the whole list. It seems to cancel out the search as soon as I hit space, so I can't narrow the results either.

When creating events with attached Snowplow contexts, the schema of the context have to be pinned. But the schema property still shows up in the Codegen code wrongly: ``` Avo.orderCompleted({ product: product, /* list of ({ "schema": string, "id": string, "name": nullable string, "category": string, "price": (min 0 max 9999999), "list_price": nullable (min 0 max 9999999), "quantity": nullable (min 0 max 9999999), "variant": nullable string, "brand": nullable string, "inventory_status": nullable string, "position": nullable (min 0 max 9999999), "currency": string, "creative_id": nullable string, }) */ transaction: transaction, /* ({ "schema": string, "transaction_id": string, "revenue": (min 0 max 9999999), "currency": string, "total_quantity": int, "tax": nullable float, "shipping": nullable float, "discount_code": nullable string, "discount_amount": nullable float, "credit_order": nullable bool, "payment_method": nullable (restricted to : "StripePayment", "SepaPayment", "PayPalPayment", "AmazonPayment"), }) */ }); ```

Our tracking plan flagged this event as not being in capital case, but the branch audit has not captured this.

When defining a string property that has a list of allowed values but is also optional, the resulting jsonschema for Snowplow is wrong. The result should include null in the list of values as so: "state": { "description": "The selection state", "type": [ "string", "null" ], "enum": [ "checked", "unchecked", null ] } However, this is the generated jsonschema: "state": { "description": "The selection state", "type": [ "string", "null" ], "enum": [ "checked", "unchecked" ] }