mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-05-24 09:03:15 -05:00
Lack of validation on name of the users #4894
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/vaultwarden#4894
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @pavel1337 on GitHub (Apr 14, 2022).
Originally assigned to: @BlackDex on GitHub.
Subject of the issue
Lack of validation on name of the users
Deployment environment
vaultwarden version: 1.24.0
Install method: Docker (Base: Debian)
Clients used: web client
MySQL/MariaDB or PostgreSQL version: MySQL 8.0.23 RDS
Other relevant details:
Steps to reproduce
pwgen 100000 1)Expected behaviour
Actual behaviour
Troubleshooting data
The command I used to create a long username:
pwgen 100000 1The screenshot of the users table; I guess it should be something like
varchar(x)The screenshot of the organization with me in it:
The screenshot of me trying create a send and developer tools
@BlackDex commented on GitHub (Jun 4, 2022):
Looks like Bitwarden it self uses a max of 50 characters. It will be a bit difficult now to switch that for Vaultwarden to a lower size if people were already using a larger amount of characters for the names.
Though limiting it a specific amount is not a bad idea, i need to see what a good amount is.
@dani-garcia commented on GitHub (Jun 4, 2022):
We could just limit it in the save function, if we don't want to create a new migration for this change
@BlackDex commented on GitHub (Jun 8, 2022):
I think it should be enough to have this only at the register function, what do you think @dani-garcia ?
That would at least prevent new users from using a large Name, but will not force current users to change it when they update there info.
btw: i have it working already locally.
@dani-garcia commented on GitHub (Jun 8, 2022):
Right, but a user could also change their name from the web vault after the account was created, I know realistically no one is going to put a long enough name to break the web vault, but we should cover all bases if possible.