RocketChat / RocketChat/Rocket.Chat

When creating a new account, an invalid username occupy an email address

Open
#30,601 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

When creating a new account, if the user types in an invalid username(in my case I have a space in between), the email(which is prompted before username) will be reserved hence it can not be used even after the user modifies the username.

I confirmed this bug by using this unit test in testing mode(follow the steps in https://developer.rocket.chat/contribute-to-rocket.chat/modes-of-contribution/assist-with-testing-rocket.chat)

it('should send email to user (return success), when is a valid email', (done) => {
			request
				.post(api('users.sendConfirmationEmail'))
				.set(credentials)
				.send({
					email: adminEmail,
				})
				.expect('Content-Type', 'application/json')
				.expect(200)
				.expect((res) => {
					expect(res.body).to.have.property('success', true);
				})
				.end(done);
		});

I first replaced the adminEmail with an email that is not valid(not existed) and this test failed. Then I tried to create an account using an invalid username(with space in between) with the same email. I clicked the "Join your team" button once and there was no response. I clicked the button once again and it prompted that the email is already existed. I ran the unit test above again and it passed which means the email is written to the database.

In the actual server, the same behavior holds.

Testing Server:
https://github.com/RocketChat/Rocket.Chat/assets/62249815/75b0d5b4-7864-4910-a975-8647dd1f3056

Actual Server:

https://github.com/RocketChat/Rocket.Chat/assets/62249815/90a3cd35-b873-4219-8214-3bc3510054b8

Steps to reproduce:
  1. Follow my procedures above.
Expected behavior:

Should not reserve the email and prompt the username is invalid.

Actual behavior:

The email is reserved and not telling the username is invalid.

Server Setup Information:
  • Version of Rocket.Chat Server: 6.5.0-develop
  • Operating System: macOS 13.4.1 (22F82)
  • Deployment Method:
  • Number of Running Instances: 1
  • DB Replicaset Oplog: Enabled
  • NodeJS Version: 14.21.4 - x64
  • MongoDB Version: 6.0.3
Client Setup Information
  • Desktop App or Browser Version:
  • Operating System:
Additional context
Relevant logs:

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the users.sendConfirmationEmail unit test and the account-creation flow described in the report, then reproduce the invalid-username case in testing mode. Trace when the email is persisted after username validation; done means an invalid username is reported without reserving the email, while the valid-email confirmation test still passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
mongodb, typescript
Domain
authentication, backend, database
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.