Users can use Roblox profile socials for other purposes

The social media profiles on Roblox can lead to links on either Twitter/YouTube that are not actually a user’s profile, which shouldn’t be the case.

The socials that users can alter are Twitter and YouTube, which are listed under people’s profiles.
image

For instance, you can log someone out of Twitter because Twitter has a logout link. (quite the prank)
image

For instance, you can attach an embed (unsure what this is capable of but I’ve blurred it for safety).
image

My understanding is that if it starts with “Twitter” or “YouTube” then it will be allowed, which shouldn’t be the case. These should be more strict, so I am regarding these as unintentional and as a bug.

31 Likes

I know, but this has been happening since profile socials were introduced, so I don’t really know about that. I would say that Roblox will go through the same problem for verifing an user just like VoiceChat. I would say this topic is good for a feature request, too.

2 Likes

Yeah, all you can really do is blacklist logout and embeds since all Twitter accounts is straight after twitter.com and with YouTube it varies, for example youtube.com/ChannelName, youtube.com/c/ChannelName, youtube.com/u/ChannelName etc.

Hope Roblox does get around to fixing this.

The youtube embed is what’s effectively a full screen youtube. It’s used for embedding in websites and such (hence the name) instead of embedding the full youtube website (with sidebar/comments/etc when you just want to put the video on) - Has the same effect as just linking to a regular video

2 Likes

this is outdated, youtube channel links are now always youtube.com/@example. the old ones still work but you can’t change them, you’re supposed to use the new @ ones (and everyone already has a new @ link, so it’s not like restricting it to just @ links excludes anyone from linking their channel)

2 Likes

I don’t think @ links was initially supported when they did launch which is interesting tbh.


Edit: Apparently was never resolved as far as I can see lol


Either way, I should probably also mention certain Twitch links such as https://twitch.tv/giftcards/buy, which will open the Twitch giftcards page in your local region for example.

Afaik there’s no other redirect links on Twitch though.

Whilst I’m here, block https://youtube.com//opensearch. Downloads a harmless XML file.

Can confirm that this is still an issue for the youtube link

Easy fix for the youtube problem is only allowing links that start with:

Roblox says the second one is the format but for some reason doesn’t check for it properly since using multiple slashes bypasses the check
Heres a roblox account I encountered that uses this bypass: VladuhaGG - Roblox