1-Letter Report Submission and Unlimited Submission Attempts
Bug Description
The report submission form allows users to:
- Submit reports with 1-letter input (e.g., "A").
- Submit reports unlimited times without rate limiting.
Steps to Reproduce
- Navigate to ArcSphere.
- Open the report submission form.
- Input a 1-letter report (e.g., "A").
- Submit the form.
- Observe that the form accepts 1-letter input.
- Submit the form multiple times.
- Observe that the form allows unlimited submissions.
Expected Behavior
- Minimum input length validation (e.g., 5+ characters).
- Rate limiting (e.g., 1 submission per minute).
Actual Behavior
- Users can submit 1-letter reports.
- No rate limiting on submissions.
Severity Classification
Severity: High
- Allows abuse (e.g., spamming 1-letter reports).
- No rate limiting increases spam risk.
Suggested Fix
Frontend Fix
- Add Input Validation: javascript
javascript const validateInput = (input) => { if (input.length < 5) throw new Error("Input must be at least 5 characters.") } - Add Rate Limiting: javascript
javascript let lastSubmitTime = 0 const submitReport = (input) => { if (Date.now() - lastSubmitTime < 60000) { alert("Wait 1 minute between submissions.") return } lastSubmitTime = Date.now() }