Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds some minor validation to catch html in the contact form fields #2548

Closed
wants to merge 1 commit into from

Conversation

dakota002
Copy link
Contributor

This will hopefully reduce the spam tickets we receive

@lpsinger @Courey Please let me know if there are additional options you can think of to catch other potentially malicious requests

@dakota002 dakota002 changed the title Adds some minor validation to catch html in the form fields Adds some minor validation to catch html in the contact form fields Aug 22, 2024
@lpsinger
Copy link
Member

I don't know about this. Legitimate support requests could contain markup.

@dakota002
Copy link
Contributor Author

Hm that is fair. What are your thoughts on updating it so that at least the checks against the subject, name, and email are not containing any, and a server side update that the email is address is correctly formatted?

Also are there any different checks you think we should add?

Copy link
Member

@lpsinger lpsinger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am concerned that this might exclude legitimate content, especially content that contains sample XML content from VOEvents.

@dakota002
Copy link
Contributor Author

Right, what are your thoughts on my previous comment though? Email Name and Subject fields only then?

@lpsinger
Copy link
Member

lpsinger commented Sep 4, 2024

Right, what are your thoughts on my previous comment though? Email Name and Subject fields only then?

I can imagine that the subject field might also legitimately contain markup.

@dakota002
Copy link
Contributor Author

Gotcha, what is your preference for this PR? Close out, or some changes?

@lpsinger
Copy link
Member

lpsinger commented Sep 5, 2024

I'm looking at the names on the tickets that we marked as spam, and this pattern would catch only some of them. It sure would be nice to have some spam filtering for tickets opened through the web form, but I think it would have to be a bit more sophisticated than a single regex.

@lpsinger lpsinger closed this Sep 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

2 participants