dashboard does not validate text fields

Metadata

Project: snapcraft (launchpad)
Number: #1750527
Type: issue
State: open
Author: ~chipaca
Labels: —
Created: 2018-02-20 09:49 AM UTC
Updated: 2020-09-21 06:23 PM UTC
Closed: —

Current evaluation

Old dashboard.snapcraft.io accepted newlines and control characters in snap Title/Summary/Description, allowing VT100 escape sequences in 'snap find' output. No labels, no comments, no activity for ~6 years; the old dashboard has since been replaced.

Suggested action: close stale

Reason: Zero comments, no labels, and no maintainer interaction for ~6 years (last activity 2170 days ago), and the issue targets the old dashboard.snapcraft.io, which has been replaced by the new store dashboard with proper field validation, so the original problem is no longer reproducible there. The residual CLI-side concern (snap find rendering unquoted summaries) should be re-verified against the current dashboard before any work is done. Confidence is moderate because repo/code tools were unavailable to confirm the current dashboard's validation behavior.

Impact: 25 Quick Win: 15.0 Staleness: 92 Complexity: 40 Confidence: 55 Support Request: 10

Issue body

It seems dashboard.snapcraft.io does little to no validation on the text fields (Title, Summary, and Description). In particular, I can have \n in title and summary, and arbitrary control characters in any of them. I'd expect the three of them to reject anything that isn't valid UTF-8; of Unicode, they should reject any control or private use character (that is: any character with class Cc or Co), and noncharacters. The exception being that description should accept \n. -- I'm tagging as a security issue because you can currently embed escape sequences into the summary, which is displayed unquoted in 'snap find' and can thus do potentially nasty things to the user's terminal. I don't think it's a _serious_ security risk, but it's nasty. "snap find counterintelligences" for a harmless example. Note the line drawing characters are done using VT100 drawing (i.e. DEC special characters set; it changes the character set the terminal uses).

Evaluation history

Date	Model	Scores	Action	Summary
2026-09-01 08:10 AM UTC	qwen/qwen3.8-27b	Impact: 25 Quick Win: 15.0 Staleness: 92 Complexity: 40 Confidence: 55 Support Request: 10	close stale	Old dashboard.snapcraft.io accepted newlines and control characters in snap Title/Summary/Description, allowing VT100 escape sequences in 'snap find' output. No labels, no comments, no activity for ~6 years; the old dashboard has since been replaced.
2026-07-23 11:55 AM UTC	qwen/qwen3.6-35b-a3b	Staleness: 95 Complexity: 30 Confidence: 85 Support Request: 10	needs triage	Missing input validation on dashboard.snapcraft.io allows control characters and terminal escape sequences in text fields, creating a minor security risk. The issue has no labels, assignee, or maintainer comments.
2026-07-22 12:19 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 95 Complexity: 55 Confidence: 90 Support Request: 10	close stale	Reports missing input validation on dashboard.snapcraft.io text fields, allowing control characters and terminal escape sequences. No maintainer response or activity in nearly 6 years.
2026-07-09 11:15 PM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 95 Complexity: 30 Confidence: 85 Support Request: 10	close stale	External contributor reported missing input validation on dashboard.snapcraft.io text fields, noting potential terminal escape injection. The report has received no maintainer response or comments in over 8 years.
2026-06-21 01:23 PM UTC	qwen3.6-35b-moe-q4	Staleness: 95 Complexity: 40 Confidence: 85 Support Request: 5	close stale	Unvalidated text fields in dashboard.snapcraft.io allow control characters and terminal escape sequences. Issue remains open with no maintainer response or labels after over 8 years.

Update history

No update history recorded yet.

Related issues

No related issues found above the similarity threshold.