dashboard does not validate text fields
Metadata
Current evaluation
Dashboard/store control-character validation was implemented in 2018, and the remaining snapd safe-display path was confirmed fixed in 2020; the Launchpad issue remains open.
Suggested action: close resolved
Reason: jdstrand stated on 2018-07-11 that the work was implemented in trunk, and anonymouse67 confirmed in 2020 that the remaining snapd safe-display issue was fixed and the task should be closed. No resolving SHA or PR is recorded in the available history, but two explicit status confirmations make the current open state stale administrative bookkeeping.
Evaluated by: mr-cal-bot
Impact:
62
Quick Win:
23
Complexity:
58
Confidence:
94
Actionability:
88
Issue body
It seems dashboard.snapcraft.io does little to no validation on the text fields (Title, Summary, and Description).
In particular, I can have \n in title and summary, and arbitrary control characters in any of them.
I'd expect the three of them to reject anything that isn't valid UTF-8; of Unicode, they should reject any control or private use character (that is: any character with class Cc or Co), and noncharacters. The exception being that description should accept \n.
--
I'm tagging as a security issue because you can currently embed escape sequences into the summary, which is displayed unquoted in 'snap find' and can thus do potentially nasty things to the user's terminal. I don't think it's a _serious_ security risk, but it's nasty.
"snap find counterintelligences" for a harmless example. Note the line drawing characters are done using VT100 drawing (i.e. DEC special characters set; it changes the character set the terminal uses).
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
62
Quick Win:
23
Complexity:
58
Confidence:
94
Actionability:
88
|
close resolved | Dashboard/store control-character validation was implemented in 2018, and the remaining snapd safe-display path was confirmed fixed in 2020; the Launchpad issue remains open. | |
| stealth/space-bunny-alpha |
Impact:
58
Quick Win:
19
Complexity:
62
Confidence:
90
Actionability:
88
|
close resolved | Control-character validation for dashboard metadata was implemented, and the remaining snapd terminal-output path was later confirmed fixed. | |
| qwen/qwen3.6-35b-a3b |
Impact:
30
Quick Win:
6
Complexity:
30
Confidence:
70
Actionability:
30
|
close not a bug | Dashboard.snapcraft.io lacks validation on text fields (Title, Summary, Description), allowing control characters that can cause terminal escape issues in 'snap find' output. | |
| qwen/qwen3.8-27b |
Impact:
25
Quick Win:
15
Staleness:
92
Complexity:
40
Confidence:
55
Support Request:
10
|
close stale | Old dashboard.snapcraft.io accepted newlines and control characters in snap Title/Summary/Description, allowing VT100 escape sequences in 'snap find' output. No labels, no comments, no activity for ~6 years; the old dashboard has since been replaced. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
30
Confidence:
85
Support Request:
10
|
needs triage | Missing input validation on dashboard.snapcraft.io allows control characters and terminal escape sequences in text fields, creating a minor security risk. The issue has no labels, assignee, or maintainer comments. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
55
Confidence:
90
Support Request:
10
|
close stale | Reports missing input validation on dashboard.snapcraft.io text fields, allowing control characters and terminal escape sequences. No maintainer response or activity in nearly 6 years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
30
Confidence:
85
Support Request:
10
|
close stale | External contributor reported missing input validation on dashboard.snapcraft.io text fields, noting potential terminal escape injection. The report has received no maintainer response or comments in over 8 years. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
No related issues found above the similarity threshold.