search

ARPspoofing / pe

0 stars 0 forks source link

Invalid email domain name allowed on edit #6

Open ARPspoofing opened 1 year ago

ARPspoofing commented 1 year ago

I do not think we should allow the user to edit the domain name to simply at least 2 characters. There should at least be a check to ensure it ends with .com or .edu etc.

Steps to reproduce:

  1. clear
  2. add n/Wen Li e/e07123456@u.nus.edu p/91234567 a/Kent Ridge PGPR tele/@wenlisan r/Very hardworking :)
  3. edit 1 e/e@aa

This solution should be solved if the domain name is strictly @u.nus.edu. This way, we can better scope it to the product since it is meant for NUS TAs, which means the students must be NUS students. Since the students are NUS students, it also means they will have a valid NUS email.

nus-se-script commented 1 year ago

Team's Response

While we do understand your point about the invalid email address, we however did not intend for the email field to strictly be the student's NUS email, and we intended for it to include a student's external email address as well. In reality, an email's domain name can be changed easily, so there are many permutations of valid email addresses. We also feel that this does not really affect the user experience, except for cases where the user make typos to the email domain, where it can be easily edited.

Items for the Tester to Verify

:question: Issue response

Team chose [response.Rejected]

Reason for disagreement: I do not understand why are you guys arguing that having an email field to exist without at least a .com or .edu etc is valid. Yes, there are so many permutations of an email, but no email address exist by just ending with @aa. In fact, the AB3 email regex checked for that, so clearly you guys removed it. This definitely should not have been rejected, even though there can be many different permutations of email that exist. At least implement some form of domain handling would be reasonable.

## :question: Issue severity Team chose [`severity.Low`] Originally [`severity.Medium`] - [x] I disagree **Reason for disagreement:** This is not a severity low, it should be medium because: 1. Invalid email domain is crucial so that the person can be contacted. 2. It affects the functionality of the application because it is centred around contacting the person.