RocketChat / RocketChat/Rocket.Chat
Avatar URL is not escaped
Open
@rodrigok is already working on this.
Since Aug 3, 2017.
type: bug
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
Avatar URLs for the CSS URL property are written without any quotes, any names which contain brackets do not render their avatar.
Profile names are created through OAuth and are not subject to the validation rules on the registration or change name pages.
Server Setup Information:
- Version of Rocket.Chat Server: 0.56.0
- Operating System: Ubuntu
- Deployment Method(snap/docker/tar/etc): Docker
- Number of Running Instances: 3+
- DB Replicaset Oplog: enabled
- Node Version: 0.4.5
Steps to Reproduce:
- Register a user through OAuth with a name including ( or ) e.g. broken()~
- Use the default avatar
Expected behavior:
Avatar displayed everywhere:
<div class="avatar-image" style="background-image:url('/avatar/broken()~?_dc=undefined');"></div>
Actual behavior:
Avatar is never displayed:
<div class="avatar-image" style="background-image:url(/avatar/broken()?_dc=undefined);"></div>
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.