Able to Submit Invalid Friend Name (Special Characters) Without Validation or Warning

Summary

In the AISTRO Friends feature, users can submit invalid names (such as special characters or symbols) without any validation or warning message. The system still accepts the invalid input and even rewards 50 points, allowing users to exploit the feature.

Steps to Reproduce

Log in to AISTRO.

Go to the Friends section (e.g., Add Friend).

Enter an invalid name such as @#$%^&*, !!!, or 123@@!!.

Submit the form.

Observe that the submission succeeds and 50 points are rewarded.

Expected Result

The app should validate the input and show a clear message such as:

“Invalid name. Please use letters and numbers only.”

No points should be awarded for invalid submissions.

The system should reject names containing special characters, emojis, or empty strings.

Actual Result

Invalid names (e.g., @@@, !!!, #$$) are accepted.

No error message or validation prompt appears.

User still earns 50 points, which can be abused repeatedly.

Impact

Data integrity issue: Friend list contains invalid or meaningless names.

Security/abuse risk: Users can spam invalid submissions to farm points.

UX issue: No feedback or validation leads to confusion.

Reputation impact: Exploitable reward system can be abused.

⚠️ Severity: High (Data validation + Reward system exploit).