Skip to content

Warning: removes relevant characters from usernames in the channel list #2982

@serious-angel

Description

@serious-angel

Dear Developers,

Thank you for the project.

A warning just to highlight the issue.

Due to Discord channel name formation procedure limitations, it appears only few characters are allowed in the channel name(username based), hence the function format_channel_name.

The line: https://github.com/antigravities/modmail/blob/3f2b9a5b0a4180ec574325d364770bbbbad4ddf4/core/utils.py#L349

# ...
name = new_name = (
    "".join(l for l in name if l not in string.punctuation and l.isprintable()) or "null"
) + f"-{author.discriminator}"
# ...

For example, my username starts with /\ngel#???? which appears ngel-???? in the channel list:

As the result, this may cause different users like ngel#???? or ^ngel#???? and actual me(/\ngel#????) appear in the channel like ngel-???? and ngel-????_1 and confuse a moderator. This may lead to an accidental private data leak.

Best and kind regards ✨

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions