Merge pull request puppetlabs#71 from runningman/security

Fixed regex of database user.
althalus · May 7, 2012 · 05f7807 · 05f7807
2 parents ed62777 + eaf9ee5
commit 05f7807
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/lib/puppet/type/database_user.rb b/lib/puppet/type/database_user.rb
@@ -7,7 +7,9 @@
   newparam(:name, :namevar=>true) do
     desc "The name of the user. This uses the 'username@hostname' or username@hostname."
     validate do |value|
-      raise(ArgumentError, "Invalid database user #{value}") unless value =~ /\w+@[\w%]+/
+      # https://dev.mysql.com/doc/refman/5.1/en/account-names.html
+      # Regex should problably be more like this: /^[`'"]?[^`'"]*[`'"]?@[`'"]?[\w%\.]+[`'"]?$/
+      raise(ArgumentError, "Invalid database user #{value}") unless value =~ /[\w-]*@[\w%\.]+/
       username = value.split('@')[0]
       if username.size > 16
         raise ArgumentError, "MySQL usernames are limited to a maximum of 16 characters"