HexBrain

Mavenlink · Report #28632

Email field filtering problem.

Validstatus
4upvotes
17 Nov 2014disclosed

How it was found

From the page: https://app.mavenlink.com/settings/email When I tried to update the email address, I noticed that the database field was allocating 255 characters there.And if the input was more than 255 character that field was truncating. For example:

haxorsistz+axorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxoailrsistzhaxoaaaaaaaa@gmail.com

This is a 265 character address.Though as per RFC the maximum length allowed for an email address is 255 characters. But when I submitted that info,that was truncated and stored first 255 characters to the database.So the email address which was stored into database was:

haxorsistz+axorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxoailrsistzhaxoaaaaaaaa

Which is an invalid email address,without any @ and trailing domain name.

So,I suggest mavenlink to check the submitted character length and the validity of that email address before storing it to database to prevent further errors.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original