getgems-io / getgems-io/issues
Ability to add more characters than the limit to NFT Name/Profile Description
- Dominant language
- No language data
- Stars
- 76
- Forks
- 32
- PR merge metrics
- No merged PRs in 30d
Description
### Bug Type
Functional
### Reproduction steps
Go to https://getgems.io/ (or https://testnet.getgems.io/)
Login with any wallet
Click "Create NFT" and select "Single NFT", or "NFT in collection"
Fill in all the fields
Open Burp or any other program that allows you to edit requests before submitting
Connect to a proxy, or open Burp Browser
Click on the "Intercept is off" button in Burp
Click on the "Create NFT" button and confirm minting
In Burp, press Forward until you see the request "POST /graphql"
Change the value of the name (or description) parameter to a value with more characters than the limit
Disable Intercept and mint NFT as usual
### Actual result
NFT minting with a name whose number of characters is more than the limit
### Expected result
Getgems should show an error as it is not possible to create an NFT with more than the character limit in the name
### Suggested Severity
Low
### Device
Desktop (please complete the following information):
OS: [e.g. iOS]: Windows 11 25151.1010
Browser [e.g. chrome, safari]: Burp Browser (based on Chromium 105)
Version [e.g. 22]: 105.0.5195.102
### Additional Context
You can do the same with your profile description
NFT Example: https://testnet.getgems.io/nft/EQCG-OSV6d1ExoxaQ7Tuc3v8HbVNRKLGK9hTlsprQvsG4Fjt
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the POST /graphql request used when minting an NFT and locate validation for the NFT name and profile description. Reproduce the oversized values from the report, then verify that the request is rejected and no NFT is minted when either value exceeds its limit.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql
- Domain
- api, blockchain
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100