RocketChat / RocketChat/Rocket.Chat

BUG: Incoming WebHook Alias field accepts invalid values without validation

Open
#38,849 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type: bug valid
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:
The Alias field in Incoming WebHook accepts invalid input (very long strings and unsupported special characters) without validation. This can lead to malformed sender names in posted messages.

Steps to reproduce:
Go to Administration → Workspace → Integrations → New Integration → Incoming WebHook.
Fill required fields (Name, Channel, etc).
In Alias, enter an invalid value (for ex: 300+ characters or symbols like @#$$).
Save the integration.
Trigger the webhook with a test payload.
Expected behavior:
Alias should be validated on save (length + allowed characters). Invalid input should show a validation error and should not be saved.

Actual behavior:
Invalid alias values are accepted and used in webhook messages.

Server Setup Information:
Version of Rocket.Chat Server: 7.8.0
License Type: Community
Operating System: macOS 15.6.1
Client Setup Information
Desktop App or Browser Version: Google Chrome 145.0.7632.76
Operating System: macOS 15.6.1
Additional context
Validation exists for other webhook-related fields, so applying similar validation for Alias would keep behavior consistent.

Relevant logs:
No server crash logs observed. I can provide browser request/response details if needed.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start from the Incoming WebHook integration flow reached through Administration → Workspace → Integrations → New Integration and trace Alias handling during save. Confirm the allowed-character and length rules, then verify invalid aliases produce a validation error, are not saved, and do not appear in webhook messages.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.