Able to Enter Invalid Slack Link in ArcBlock Community User Settings
On the ArcBlock Community settings page (https://community.arcblock.io/.well-known/service/user/settings?locale=en), users are able to save invalid Slack links. The system does not validate whether the entered link is a proper Slack workspace or channel URL.
Steps to Reproduce:
- Log in to ArcBlock Community.
- Navigate to User Settings → Slack link field.
- Enter an invalid Slack link (e.g.,
https://example.com/fake-slack)..) - Save changes.
- Observe that the invalid link is accepted.
Expected Result:
- The system should validate Slack links before saving.
- Only links that match Slack’s URL format (
https://[workspace].slack.com/...) should be allowed.
Actual Result:
- Any invalid or non-Slack URL can be entered and saved successfully.
- No validation or error message is displayed.
Bug Description: The Slack link field in ArcBlock Community lacks input validation, allowing incorrect or malicious links to be stored. This could:
- Confuse users with broken links.
- Allow phishing or malicious URLs disguised as Slack links.
Severity Classification:
- Severity Level: 🟠 Medium (input validation flaw with potential abuse).
Suggested Fix:
- Implement strict input validation for Slack URLs.
- Only allow links with Slack domain patterns (
.slack.com). - Display error message if the link is invalid.
- Sanitize and verify before saving.
Priority: ⚠️ Medium – Should be fixed soon to prevent misuse.
1 reply
This can also be a custom webhook URL; it doesn't have to be Slack.