diff options
author | Dessalines <dessalines@users.noreply.github.com> | 2020-05-28 14:07:36 -0400 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-05-28 14:07:36 -0400 |
commit | 29fc3681b9c3d4e630534c0f6adb0b73d7fcf04f (patch) | |
tree | 84c4d90a6afb84cbee6c2af797f570e509e47018 /server/src | |
parent | 871f09d109ba3c6d7c291e46408a6021ccaa7b77 (diff) |
Validate register usernames on the back-end. Fixes #716 (#750)
* Validate register usernames on the back-end. Fixes #716
* Changing name to is_valid_username
Diffstat (limited to 'server/src')
-rw-r--r-- | server/src/api/user.rs | 5 | ||||
-rw-r--r-- | server/src/lib.rs | 18 |
2 files changed, 21 insertions, 2 deletions
diff --git a/server/src/api/user.rs b/server/src/api/user.rs index c2734f51..ee57723a 100644 --- a/server/src/api/user.rs +++ b/server/src/api/user.rs @@ -1,4 +1,5 @@ use super::*; +use crate::is_valid_username; use bcrypt::verify; #[derive(Serialize, Deserialize, Debug)] @@ -261,6 +262,10 @@ impl Perform for Oper<Register> { return Err(APIError::err("admin_already_created").into()); } + if !is_valid_username(&data.username) { + return Err(APIError::err("invalid_username").into()); + } + // Register the new user let user_form = UserForm { name: data.username.to_owned(), diff --git a/server/src/lib.rs b/server/src/lib.rs index d1531d7e..ca4bedea 100644 --- a/server/src/lib.rs +++ b/server/src/lib.rs @@ -269,11 +269,15 @@ pub fn get_ip(conn_info: &ConnectionInfo) -> String { .to_string() } +pub fn is_valid_username(name: &str) -> bool { + VALID_USERNAME_REGEX.is_match(name) +} + #[cfg(test)] mod tests { use crate::{ - extract_usernames, is_email_regex, is_image_content_type, remove_slurs, slur_check, - slurs_vec_to_str, + extract_usernames, is_email_regex, is_image_content_type, is_valid_username, remove_slurs, + slur_check, slurs_vec_to_str, }; #[test] @@ -292,6 +296,15 @@ mod tests { } #[test] + fn test_valid_register_username() { + assert!(is_valid_username("Hello_98")); + assert!(is_valid_username("ten")); + assert!(!is_valid_username("Hello-98")); + assert!(!is_valid_username("a")); + assert!(!is_valid_username("")); + } + + #[test] fn test_slur_filter() { let test = "coons test dindu ladyboy tranny retardeds. Capitalized Niggerz. This is a bunch of other safe text."; @@ -352,4 +365,5 @@ lazy_static! { static ref EMAIL_REGEX: Regex = Regex::new(r"^[a-zA-Z0-9.!#$%&’*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$").unwrap(); static ref SLUR_REGEX: Regex = RegexBuilder::new(r"(fag(g|got|tard)?|maricos?|cock\s?sucker(s|ing)?|nig(\b|g?(a|er)?(s|z)?)\b|dindu(s?)|mudslime?s?|kikes?|mongoloids?|towel\s*heads?|\bspi(c|k)s?\b|\bchinks?|niglets?|beaners?|\bnips?\b|\bcoons?\b|jungle\s*bunn(y|ies?)|jigg?aboo?s?|\bpakis?\b|rag\s*heads?|gooks?|cunts?|bitch(es|ing|y)?|puss(y|ies?)|twats?|feminazis?|whor(es?|ing)|\bslut(s|t?y)?|\btrann?(y|ies?)|ladyboy(s?)|\b(b|re|r)tard(ed)?s?)").case_insensitive(true).build().unwrap(); static ref USERNAME_MATCHES_REGEX: Regex = Regex::new(r"/u/[a-zA-Z][0-9a-zA-Z_]*").unwrap(); + static ref VALID_USERNAME_REGEX: Regex = Regex::new(r"^[a-zA-Z0-9_]{3,20}$").unwrap(); } |