RocketChat / RocketChat/Rocket.Chat
BUG: Incoming WebHook Alias field accepts invalid values without validation
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
The Alias field in Incoming WebHook accepts invalid input (very long strings and unsupported special characters) without validation. This can lead to malformed sender names in posted messages.
Steps to reproduce:
Go to Administration → Workspace → Integrations → New Integration → Incoming WebHook.
Fill required fields (Name, Channel, etc).
In Alias, enter an invalid value (for ex: 300+ characters or symbols like @#$$).
Save the integration.
Trigger the webhook with a test payload.
Expected behavior:
Alias should be validated on save (length + allowed characters). Invalid input should show a validation error and should not be saved.
Actual behavior:
Invalid alias values are accepted and used in webhook messages.
Server Setup Information:
Version of Rocket.Chat Server: 7.8.0
License Type: Community
Operating System: macOS 15.6.1
Client Setup Information
Desktop App or Browser Version: Google Chrome 145.0.7632.76
Operating System: macOS 15.6.1
Additional context
Validation exists for other webhook-related fields, so applying similar validation for Alias would keep behavior consistent.
Relevant logs:
No server crash logs observed. I can provide browser request/response details if needed.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start from the Incoming WebHook integration flow reached through Administration → Workspace → Integrations → New Integration and trace Alias handling during save. Confirm the allowed-character and length rules, then verify invalid aliases produce a validation error, are not saved, and do not appear in webhook messages.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100