RocketChat / RocketChat/Rocket.Chat

Avatar URL is not escaped

Open
#7,650 0 comments 0 reactions 1 assignee View on GitHub

@rodrigok is already working on this.

Since Aug 3, 2017.

type: bug
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

Avatar URLs for the CSS URL property are written without any quotes, any names which contain brackets do not render their avatar.

Profile names are created through OAuth and are not subject to the validation rules on the registration or change name pages.

Server Setup Information:
  • Version of Rocket.Chat Server: 0.56.0
  • Operating System: Ubuntu
  • Deployment Method(snap/docker/tar/etc): Docker
  • Number of Running Instances: 3+
  • DB Replicaset Oplog: enabled
  • Node Version: 0.4.5
Steps to Reproduce:
  1. Register a user through OAuth with a name including ( or ) e.g. broken()~
  2. Use the default avatar
Expected behavior:

Avatar displayed everywhere:
<div class="avatar-image" style="background-image:url('/avatar/broken()~?_dc=undefined');"></div>

Actual behavior:

Avatar is never displayed:
<div class="avatar-image" style="background-image:url(/avatar/broken()?_dc=undefined);"></div>

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.