IntersectMBO / IntersectMBO/govtool

🐛 Invalid Link Validation Bypassed in Proposal Creation via UI and API

Open
#3,715 2 comments 0 reactions 2 assignees Claimed by @MihajlovicMilos1995 View on GitHub
🐛 Bug 📜 Proposal Pillar 🕵️‍♂️ Testing
Dominant language
HTML
Stars
21
Forks
29
Avg merge
2d 22h
Merged PRs (30d)
7

Description

### Area

Proposal Pillar

### Domain

Custom setup

### Which wallet were you using?

_No response_

### Context

When creating a proposal through the UI, entering an invalid link in the link field correctly displays an error message. However, adding a space or typing and then removing text in the link field causes the error message to disappear, enabling the "Continue" button and allowing progression despite the invalid link. Additionally, the API allows submission of proposals with invalid links (e.g., "invalid") without proper validation, which impacts data integrity in dbsync when the proposal is submitted as a governance action.

### Steps to reproduce

1. Connect a wallet.
2. Navigate to the proposal creation page.
3. Fill out all required fields with valid data.
4. Enter an invalid link (e.g., "invalid") in the link field to trigger the error message.
5. Add a space to the link text or enter any text and then delete it.
6. Observe that the error message disappears, and the "Continue" button becomes active, allowing progression.

**API Issue**
1. Use the following cURL command to submit a proposal with an invalid link:
```
curl 'https://z74f91f2d-zb0719f09-gtw.z937eb260.rustrocks.fr/api/proposals' \
-H 'accept: application/json, text/plain, */*' \
-H 'accept-language: en,en-GB;q=0.9,en-US;q=0.8' \
-H 'authorization: Bearer ********************************************' \
-H 'cache-control: no-cache' \
-H 'content-type: application/json' \
-H 'origin: https://p80-z78acf3c2-zded6a792-gtw.z937eb260.rustrocks.fr' \
-H 'pragma: no-cache' \
-H 'priority: u=1, i' \
-H 'referer: https://p80-z78acf3c2-zded6a792-gtw.z937eb260.rustrocks.fr/' \
-H 'sec-ch-ua: "Google Chrome";v="137", "Chromium";v="137", "Not/A)Brand";v="24"' \
-H 'sec-ch-ua-mobile: ?0' \
-H 'sec-ch-ua-platform: "Linux"' \
-H 'sec-fetch-dest: empty' \
-H 'sec-fetch-mode: cors' \
-H 'sec-fetch-site: same-site' \
-H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36' \
--data-raw '{"data":{"proposal_links":[{"prop_link":"invalid","prop_link_text":" "}],"proposal_withdrawals":[{"prop_receiving_address":null,"prop_amount":null}],"proposal_constitution_content":{},"gov_action_type_id":1,"prop_name":"vv","prop_abstract":"vv","prop_motivation":"vv","prop_rationale":"vv","is_draft":false}}'
```
2. Observe that the API accepts the invalid link ("invalid") and creates the proposal without validation errors.
3. Note that this invalid data affects dbsync when the proposal is submitted as a governance action.

### Actual behavior

- UI: Adding/removing a space or text in the link field with an invalid link removes the error message and enables the "Continue" button, allowing users to proceed with an invalid link.
- API: The API endpoint /api/proposals accepts proposals with invalid links (e.g., "invalid") without validation, leading to the creation of proposals with incorrect data, which impacts data integrity in dbsync during governance action submission.

The error message appears as expected

![Image](https://github.com/user-attachments/assets/b29f9b41-6e78-4422-9564-dce3cf1c7d99)

But when I add a space or remove the added link text, the error message vanishes, and the continue button is visible

![Image](https://github.com/user-attachments/assets/ac981aa4-8d02-410d-9950-a23cbb05127a)

### Expected behavior

- UI: The error message for an invalid link should persist as long as the link remains invalid, regardless of adding/removing spaces or text. The "Continue" button should remain disabled until a valid link (e.g., a properly formatted URL) is provided.
- API: The API should validate the prop_link field and reject submissions with invalid links, returning an appropriate error response (e.g., 400 Bad Request). Invalid data should not be stored, ensuring data integrity in DBSync for governance actions.

### Allure Report
- [7F_1. Should reject invalid data in info action Proposal form](https://intersectmbo.github.io/govtool-test-reports/qa/govtool-frontend/426/#behaviors/1c853b5eba2ae76bed30628cc87b9764/a3dd40983039f84c/)
- [7F_2. Should reject invalid data in treasury requests Proposal form](https://intersectmbo.github.io/govtool-test-reports/qa/govtool-frontend/426/#behaviors/1c853b5eba2ae76bed30628cc87b9764/a183582445355953/)
- [7F_3. Should reject invalid data in updates to the constitution Proposal form](https://intersectmbo.github.io/govtool-test-reports/qa/govtool-frontend/426/#behaviors/1c853b5eba2ae76bed30628cc87b9764/3d6071af761bca3d/)
- [7F_4. Should reject invalid data in motion of no confidence Proposal form](https://intersectmbo.github.io/govtool-test-reports/qa/govtool-frontend/426/#behaviors/1c853b5eba2ae76bed30628cc87b9764/60d6c1a7918d1dda/)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.