Link detection can be bypassed using URI encoded characters
- Dominant language
- Java
- Stars
- 600
- Forks
- 338
- PR merge metrics
- No merged PRs in 30d
Description
By using URI encoded characters it's possible to bypass Vortex's (invite) link detection. Whilst the link itself isn't clickable, an embed is still getting generated which is clickable.
The following example is for `https://discord.gg/ian` which was converted to `https://%64%69%73%63%6f%72%64%2e%67%67/%69%61%6e` using URI encoding in order to bypass the filter:

Contributor guide
No contributing guide indexed for this repository
Research direction
Start at Vortex's invite-link detection and embed-generation paths, then reproduce the encoded Discord invite example from the issue. Done means URI-encoded invite links are detected consistently and cannot produce a clickable embed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100