MySQL/MariaDB or PostgreSQL version: MySQL 8.0.23 RDS
Other relevant details:
Steps to reproduce
Receieve an invite to vaultwarden
Create account with long name (eg. using this command pwgen 100000 1)
Expected behaviour
validation error with something like "the name is too long"
Actual behaviour
I was able to create a user and login, but I cannot send secrets. I guess because the bearer token is too big, because the username is too long.
Troubleshooting data
The command I used to create a long username: pwgen 100000 1
The screenshot of the users table; I guess it should be something like varchar(x)
The screenshot of the organization with me in it:
The screenshot of me trying create a send and developer tools
Originally created by @pavel1337 on GitHub (Apr 14, 2022).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2419
Originally assigned to: @BlackDex on GitHub.
### Subject of the issue
Lack of validation on name of the users
### Deployment environment
* vaultwarden version: 1.24.0
* Install method: Docker (Base: Debian)
* Clients used: web client
* MySQL/MariaDB or PostgreSQL version: MySQL 8.0.23 RDS
* Other relevant details:
### Steps to reproduce
1. Receieve an invite to vaultwarden
2. Create account with long name (eg. using this command ```pwgen 100000 1```)
### Expected behaviour
- validation error with something like "the name is too long"
### Actual behaviour
- I was able to create a user and login, but I cannot send secrets. I guess because the bearer token is too big, because the username is too long.
### Troubleshooting data
The command I used to create a long username: ```pwgen 100000 1```
The screenshot of the users table; I guess it should be something like ```varchar(x)```
The screenshot of the organization with me in it:
The screenshot of me trying create a send and developer tools
Looks like Bitwarden it self uses a max of 50 characters. It will be a bit difficult now to switch that for Vaultwarden to a lower size if people were already using a larger amount of characters for the names.
Though limiting it a specific amount is not a bad idea, i need to see what a good amount is.
<!-- gh-comment-id:1146639573 -->
@BlackDex commented on GitHub (Jun 4, 2022):
Looks like Bitwarden it self uses a max of 50 characters. It will be a bit difficult now to switch that for Vaultwarden to a lower size if people were already using a larger amount of characters for the names.
Though limiting it a specific amount is not a bad idea, i need to see what a good amount is.
We could just limit it in the save function, if we don't want to create a new migration for this change
<!-- gh-comment-id:1146654859 -->
@dani-garcia commented on GitHub (Jun 4, 2022):
We could just limit it in the save function, if we don't want to create a new migration for this change
I think it should be enough to have this only at the register function, what do you think @dani-garcia ?
That would at least prevent new users from using a large Name, but will not force current users to change it when they update there info.
btw: i have it working already locally.
<!-- gh-comment-id:1150111774 -->
@BlackDex commented on GitHub (Jun 8, 2022):
I think it should be enough to have this only at the register function, what do you think @dani-garcia ?
That would at least prevent new users from using a large Name, but will not force current users to change it when they update there info.
btw: i have it working already locally.
Right, but a user could also change their name from the web vault after the account was created, I know realistically no one is going to put a long enough name to break the web vault, but we should cover all bases if possible.
<!-- gh-comment-id:1150155080 -->
@dani-garcia commented on GitHub (Jun 8, 2022):
Right, but a user could also change their name from the web vault after the account was created, I know realistically no one is going to put a long enough name to break the web vault, but we should cover all bases if possible.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @pavel1337 on GitHub (Apr 14, 2022).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2419
Originally assigned to: @BlackDex on GitHub.
Subject of the issue
Lack of validation on name of the users
Deployment environment
vaultwarden version: 1.24.0
Install method: Docker (Base: Debian)
Clients used: web client
MySQL/MariaDB or PostgreSQL version: MySQL 8.0.23 RDS
Other relevant details:
Steps to reproduce
pwgen 100000 1)Expected behaviour
Actual behaviour
Troubleshooting data
The command I used to create a long username:
pwgen 100000 1The screenshot of the users table; I guess it should be something like
varchar(x)The screenshot of the organization with me in it:
The screenshot of me trying create a send and developer tools
@BlackDex commented on GitHub (Jun 4, 2022):
Looks like Bitwarden it self uses a max of 50 characters. It will be a bit difficult now to switch that for Vaultwarden to a lower size if people were already using a larger amount of characters for the names.
Though limiting it a specific amount is not a bad idea, i need to see what a good amount is.
@dani-garcia commented on GitHub (Jun 4, 2022):
We could just limit it in the save function, if we don't want to create a new migration for this change
@BlackDex commented on GitHub (Jun 8, 2022):
I think it should be enough to have this only at the register function, what do you think @dani-garcia ?
That would at least prevent new users from using a large Name, but will not force current users to change it when they update there info.
btw: i have it working already locally.
@dani-garcia commented on GitHub (Jun 8, 2022):
Right, but a user could also change their name from the web vault after the account was created, I know realistically no one is going to put a long enough name to break the web vault, but we should cover all bases if possible.