Skip to content

You can effectively ban a user by sending a corrupted message #189

@Kistras

Description

@Kistras

Was making a quick bot and found out that you can send a message with custom contents. It's not validated on either server-side or client-side, resulting in crashes once someone opens the chat the message was sent it. This message doesn't appear in previews so the app technically remains useable, but requires reloads as soon as you open DMs with user who sent you this message. If you actually confirm it then it does appear in preview and effectively bans the user (see second screenshot).

Topic that raised this error (notice the nested text object):

{
  "id": "eb0c8144-4e25-4e57-8cd6-cdbef85fa3b6",
  "revision": 81,
  "data": {
    "detailRevision": 81,
    "tagRevision": 81,
    "topicDetail": {
      "guid": "4966b2adcae260baa492446e66efbd6efd127d0e42653ef66eb33e9bab1ddbab",
      "dataType": "superbasictext",
      "data": "{\"text\": {\"text\": \"pong\", \"textColor\": null, \"textSize\": null, \"assets\": null}}",
      "created": 1775548125,
      "updated": 1775548125,
      "status": "unconfirmed",
      "transform": "complete"
    }
  }
}

Error:

Image

Error that appears when it tries to load a preview of a confirmed message with weird data.text:

Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions