jagrosh / jagrosh/Vortex

Link detection can be bypassed using URI encoded characters

Open
#118 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
600
Forks
338
PR merge metrics
No merged PRs in 30d

Description

By using URI encoded characters it's possible to bypass Vortex's (invite) link detection. Whilst the link itself isn't clickable, an embed is still getting generated which is clickable.
The following example is for `https://discord.gg/ian` which was converted to `https://%64%69%73%63%6f%72%64%2e%67%67/%69%61%6e` using URI encoding in order to bypass the filter:
![image](https://user-images.githubusercontent.com/17235016/138594980-13edfa40-bb89-4dee-b75c-d00ac41e1ee9.png)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at Vortex's invite-link detection and embed-generation paths, then reproduce the encoded Discord invite example from the issue. Done means URI-encoded invite links are detected consistently and cannot produce a clickable embed.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.