Dangerous UI pattern (how to accidentally block the world)

[tyrosinase]

Steps to reproduce the problem

1. Check for an existing instance block in the admin interface
2. Use a partial domain name to find it. Let's use "com" as the example.
3. Ah, there it is, "compromised.site.really.bad". Let's suspend it.
4. Type "compromised.site.really.bad" in the box, hit "Add new domain block."
5. Type a reason, hit "suspend."
6. ... say some bad swears ...
7. Restore a backup.

Expected behaviour

One site should have been suspended, the one I just typed

Actual behaviour

Every dot-com site just got suspended, because it pulled the last search instead. Yikes!

Detailed description

(for the record, I did not actually do this, this is a worst-case situation, but I have sure enough suspended some fortunately-nonexistent partial domains for a few seconds)

Specifications

Mastodon 4.0.2 (masto.host hosted)

[rbairwell]

Out of interest, how would you prefer this to fixed? If there is a lot of abuse happening, then mods may want to block a lot of domains quickly and don't want to go through a confirmation screen everytime.

I was going to suggest perhaps have a block on just allowing entry of domains listed in Mozilla's Public Suffix List : but there are dynamic domains/subdomains listed there which some admins may want to block to prevent "pop-up abuse instances" on free subdomains.

[trwnh]

@rbairwell it sounds like the domain block functionality is pulling from the search query rather than from the domain entered into the form? it doesn't sound like it has anything to do with confirmation screens

[tyrosinase]

It would mostly be fixed if step 4 up there was actually recognized by the "Add domain block" button. It looks like a form but it does not behave like one, and that's very wrong. Sure, the thing you're actually going to block appears in the box on the next screen, but if you don't double-check it it will bite you.

Having a confirmation on whole-TLD blocks might separately be a useful thing, but will not solve the underlying problem. It is far, far more frequent to go "oh no, was that a .club or a .camp?" and type the part you can remember, then go "ah ha" and type the rest of it and hit "add new domain block" expecting it to behave like every other form. (Yes, one could click the domain in the results, but that's an extra screen to click through.)

(@trwnh: Yep, that appears to be what is happening, probably yoinking it from the uri instead of the field but I haven't looked closely)

[rbairwell]

Okay - I see, if you change the Search field (on Moderation->Federation) and then click "Add new domain block" without click "Search" it passes the previous entry in the search field to the "Add new domain block" page (where it is editable). Sorry for the misunderstanding/reading of the steps.