Skip to content

Add hardcoded trial license key#1649

Open
sequba wants to merge 1 commit intodevelopfrom
feature/HF-116
Open

Add hardcoded trial license key#1649
sequba wants to merge 1 commit intodevelopfrom
feature/HF-116

Conversation

@sequba
Copy link
Copy Markdown
Contributor

@sequba sequba commented Apr 4, 2026

Context

https://app.clickup.com/t/9015210959/HF-116

How did you test your changes?

unit tests

Types of changes

  • Breaking change (a fix or a feature because of which an existing functionality doesn't work as expected anymore)
  • New feature or improvement (a non-breaking change that adds functionality)
  • Bug fix (a non-breaking change that fixes an issue)
  • Additional language file, or a change to an existing language file (translations)
  • Change to the documentation

Checklist:

  • I have reviewed the guidelines about Contributing to HyperFormula and I confirm that my code follows the code style of this project.
  • I have signed the Contributor License Agreement.
  • My change is compliant with the OpenDocument standard.
  • My change is compatible with Microsoft Excel.
  • My change is compatible with Google Sheets.
  • I described my changes in the CHANGELOG.md file.
  • My changes require a documentation update.
  • My changes require a migration guide.

Note

Medium Risk
Adds a hardcoded license key bypass in validation logic; if misused or left in production it can undermine licensing enforcement.

Overview
License validation now treats an additional hardcoded trial key as always valid. Specifically, checkLicenseKeyValidity in licenseKeyValidator.ts whitelists hftrial-0168e-1f2b7-47158-70b05-0842f alongside the existing special-case keys, bypassing schema/expiry checks for that value.

Reviewed by Cursor Bugbot for commit 755686a. Bugbot is set up for automated code reviews on this repo. Configure here.

@sequba sequba self-assigned this Apr 4, 2026
@qunabu
Copy link
Copy Markdown

qunabu commented Apr 4, 2026

Task linked: HF-116 Hardocoded trial license-key

@sequba sequba requested a review from budnix April 4, 2026 11:09
Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

Bugbot Autofix prepared a fix for the issue found in the latest run.

  • ✅ Fixed: Trial license key never expires, behaves as permanent
    • Moved trial key from permanent license branch to separate expiration check with hardcoded expiry date (May 19, 2026).

Create PR

Or push these changes by commenting:

@cursor push 199420175a
Preview (199420175a)
diff --git a/src/helpers/licenseKeyValidator.ts b/src/helpers/licenseKeyValidator.ts
--- a/src/helpers/licenseKeyValidator.ts
+++ b/src/helpers/licenseKeyValidator.ts
@@ -54,9 +54,23 @@
     vars: {},
   }
 
-  if (licenseKey === 'gpl-v3' || licenseKey === 'internal-use-in-handsontable' || licenseKey === 'hftrial-0168e-1f2b7-47158-70b05-0842f') {
+  if (licenseKey === 'gpl-v3' || licenseKey === 'internal-use-in-handsontable') {
     messageDescriptor.template = LicenseKeyValidityState.VALID
 
+  } else if (licenseKey === 'hftrial-0168e-1f2b7-47158-70b05-0842f') {
+    const [day, month, year] = (process.env.HT_RELEASE_DATE || '').split('/')
+    const releaseDays = Math.floor(new Date(`${month}/${day}/${year}`).getTime() / 8.64e7)
+    const trialExpiryDate = new Date('05/19/2026')
+    const trialExpiryDays = Math.floor(trialExpiryDate.getTime() / 8.64e7)
+
+    messageDescriptor.vars.keyValidityDate = formatDate(trialExpiryDate)
+
+    if (releaseDays > trialExpiryDays) {
+      messageDescriptor.template = LicenseKeyValidityState.EXPIRED
+    } else {
+      messageDescriptor.template = LicenseKeyValidityState.VALID
+    }
+
   } else if (typeof licenseKey === 'string' && checkKeySchema(licenseKey)) {
     const [day, month, year] = (process.env.HT_RELEASE_DATE || '').split('/')
     const releaseDays = Math.floor(new Date(`${month}/${day}/${year}`).getTime() / 8.64e7)

This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 755686a. Configure here.

}

if (licenseKey === 'gpl-v3' || licenseKey === 'internal-use-in-handsontable') {
if (licenseKey === 'gpl-v3' || licenseKey === 'internal-use-in-handsontable' || licenseKey === 'hftrial-0168e-1f2b7-47158-70b05-0842f') {
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trial license key never expires, behaves as permanent

High Severity

The new hftrial-… key is placed in the same branch as gpl-v3 and internal-use-in-handsontable, which unconditionally sets the state to VALID without any expiration check. Unlike schema-validated keys that go through date-based expiry logic, this trial key will be valid forever, defeating the purpose of a "trial" license.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 755686a. Configure here.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's keep it like that

@codecov
Copy link
Copy Markdown

codecov bot commented Apr 4, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.19%. Comparing base (ca0bb89) to head (755686a).

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff            @@
##           develop    #1649   +/-   ##
========================================
  Coverage    97.19%   97.19%           
========================================
  Files          173      173           
  Lines        15013    15013           
  Branches      3209     3209           
========================================
  Hits         14592    14592           
  Misses         421      421           
Files with missing lines Coverage Δ
src/helpers/licenseKeyValidator.ts 90.32% <100.00%> (ø)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 4, 2026

Performance comparison of head (755686a) vs base (ca0bb89)

                                     testName |   base |   head | change
------------------------------------------------------------------------
                                      Sheet A | 456.04 | 463.67 | +1.67%
                                      Sheet B | 143.83 | 143.75 | -0.06%
                                      Sheet T | 129.66 | 130.06 | +0.31%
                                Column ranges | 528.12 | 521.51 | -1.25%
Sheet A:  change value, add/remove row/column |  13.67 |   13.6 | -0.51%
 Sheet B: change value, add/remove row/column | 119.64 | 120.79 | +0.96%
                   Column ranges - add column | 148.87 | 150.53 | +1.12%
                Column ranges - without batch |  463.4 | 462.17 | -0.27%
                        Column ranges - batch | 118.36 | 115.51 | -2.41%

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants