Wednesday, October 31, 2018

Bed Bath & Beyond - Account Creation - Misleading Error Message

Bed Bath & Beyond app for iOS (version 7.5.2)
Date: 10/31/2018

Description:

There is a misleading error message during account creation on the Bed Bath & Beyond iOS app. While this problem/bug is extremely minor, I actually think that it is pointing to another bug, which could be worse - at least from the point of view of having a smooth account creation process.

This is easier to show than it is to describe, so please see the attached screenshots.

The user is prohibited from entering in an apostrophe in the Last Name field during the sign up process. This wouldn't be a big deal, except that if the user tries to enter in a Last Name with an apostrophe, a big red error message appears that says, "Please enter letters, apostrophes, hyphens, and spaces only."

The error message specifically tells me that apostrophes are allowed - so why am I seeing this error message.

Also, oddly, the automatically generated email suggestion field pops up as soon as I click in the "Last Name" input box. Isn't this supposed to show up from the email input box at the top of the page? Was the email input box moved to the top of the screen, but the keyboard still thinks it is in third position?

Just a little frustrating for the user!


Steps to Reproduce:
1. Download and launch the Bed Bath & Beyond app for iOS (version 7.5.2)
2. Select "More" from the bottom UI
3. Select "Create Account"
4. From the "Create Account" page enter in a valid email
5. From the "Create Account" page enter in a valid First Name
6. From the "Create Account" page, click inside the Last Name input box (note that the auto-generated, saved email feature pops up at this point. Which is weird)
7. Inside of the Last Name input box, enter in an Irish name like "O'connor"
8. After hitting next to advance to the password input box, note the error message, "Please enter letters, apostrophes, hyphens, and spaces only"
9. Scratch your head and wonder why "O'connor" isn't acceptable as a last name

Result: User is apparently prohibited from using a last name with an apostrophe in it, even though an error message message claims that it is allowed

Expected: Either the user should be allowed to have a last name with an apostrophe, or the error message should be amended to state that apostrophe's aren't allowed

After launching the app, click on "More"...

Enter in a name like "O'Connor" into the last name input box. The error message tells me that apostrophes are allowed...

In addition - it gets stranger! When I first click into the Last Name input box, the auto generated email thing in the keyboard shows up. Instead of when I first click in the email input box. Frustrating!

Thursday, October 25, 2018

Sky News iOS app - Twitter Sharing - No links to articles

Sky News app for iOS (version 4.11.1)
Date: 10/26/2018

Description:

Twitter sharing from the Sky News iOS app to Twitter doesn't work. It only shares an image and headline related to an article, not a link to it. Loss of potential traffic to the site.

Easier to show than to describe, so please see the attached screenshots.

Steps to Reproduce:

1. Download the Sky New iOS app (version 4.11.1)
2. Go to the most recent article
3. Click on the iOS share option in upper right
4. Select the twitter option
5. Note that generate tweet only has headline and picture - no link to article

Result: No links to articles in tweets

Expected: Links to articles in tweets

Select an article...

Select the twitter share icon...

No link to article.

Thursday, October 18, 2018

Victoria's Secret app: XSS: A plaintext search results in a cross site scripting error

Victoria's Secret app for iOS (version 5.4.2)
Date: 10/18/2018

Description:

The most common self-reflecting XSS bug is active with the Victoria's App for iOS.

If the user searches for "<plaintext>" in the search box, the app barfs up HTML.

Easier to show than to describe, so please see the attached screenshots.

Steps to Reproduce:

1. Download and launch the Victoria's Secret app for iOS (version 5.4.2)
2. Click on "SHOP"
3. Click inside the magnifying glass to search
4. Enter in <plaintext> as a search term
5. Run a search

Result: There is an cross site scripting error if the user runs a search for "<plaintext>"

Expected: There should not be a cross site scripting error if the user runs a search for "<plaintext>"

Launch the app, then click on "SHOP"...

Click on the magnifying glass...

Run a search in this search box...

Enter in <plaintext> as a search term...

Barfs HTML.

Tuesday, October 9, 2018

JCPenney - Account Creation - The "Next" keyboard button doesn't advance the user

JCPenney App for iOS (version 8.9.2)
Date: 10/10/2018

Description:

On the "Create Account" screen, the "Next" button doesn't advance the user to the next input box. This is very noticeable!

This is easier to show than to describe, so please take a look at the attached screenshots.

Steps to Reproduce:

1. Download and launch the JCPenney App for iOS
2. Advance to the "Create Account" screen
3. Click inside the "First Name" input box
4. Enter in a valid first name
5. Click "Next" on the keyboard

Result: The "Next" button on the keyboard does not advance the user to the next input box on the "Create Account" screen

Expected: The "Next" button on the keyboard should advance the user to the next input box on the "Create Account" screen

Download and launch the JCPenney app (version 8.9.2)

Select the "Create Account" button...

The "Next" button on the keyboard doesn't advance the user to the next input box.

Friday, October 5, 2018

Shopbop app - Pressing "Shop by Category" and "Shop What's New" at the same time crashes the app

Shopbop App for iOS (version 3.1.1)
Date: 10/05/2018

Description:

There is an easy way to crash the Shopbop app for iOS.

Within the app there is a shopping bag icon in the upper right hand corner of the screen. After selecting this icon, you are taken to a "Shopping Bag" page. On the "Shopping Bag" page there are two options. One of these options is "Shop by Category" while the other is "Shop What's New."

If you press both of these options at the same time, the app will crash. This happens every time it is is done. I will attached a crash dump.

This is easier to show than it is to describe, so please see the attached screenshots.

Steps to Reproduce:

1. Download and launch the Shopbop app for iOS
2. Select the shopping bag icon in the upper right hand corner of the screen
3. Press and hold "Shop by Category" and "Shop What's New" simultaneously
4. Release "Shop by Category" and "Shop What's New" simultaneously

Result: Pressing, holding, and then releasing "Shop by Category" and "Shop What's New" on the Shopping Bag page crashes the app

Expected: Pressing, holding, and then releasing "Shop by Category" and "Shop What's New" simultaneously should not crash the app

Select the Shopping Bag option in the upper right...

Press "Shop by Category" and "Shop What's New" at the same time...

The app will then crash.

Here is the crash dump: