Illegal DB creation permitted

[flimzy]

Reported/asked about here: https://stackoverflow.com/q/52636973/13860

Expected Behavior

Creating a database called !abcdef/_users should fail, due to invalid DB name.

Current Behavior

DB creation succeeds:

curl -v -X PUT http://admin:abc123@localhost:6004/\!abcdef%2F_users
*   Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 6004 (#0)
* Server auth using Basic with user 'admin'
> PUT /!abcdef%2F_users HTTP/1.1
> Host: localhost:6004
> Authorization: Basic YWRtaW46YWJjMTIz
> User-Agent: curl/7.52.1
> Accept: */*
> 
< HTTP/1.1 201 Created
< Cache-Control: must-revalidate
< Content-Length: 12
< Content-Type: application/json
< Date: Sun, 07 Oct 2018 11:21:46 GMT
< Location: http://localhost:6004/%21abcdef%2F_users
< Server: CouchDB/2.2.0 (Erlang OTP/19)
< X-Couch-Request-ID: 8d5c83b3a4
< X-CouchDB-Body-Time: 0
< 
{"ok":true}
* Curl_http_done: called premature == 0
* Connection #0 to host localhost left intact

Possible Solution

Seems likely that the "special case" for _users is just too permissive, such as a regex not bound to the beginning of the string, or a similar error.

Steps to Reproduce (for bugs)

See curl command above.

Your Environment

• Version used: CouchDB 2.2.0 via official Docker image
• Browser Name and version: curl 7.52.1
• Operating System and version (desktop or mobile): Debian 9.5

[iilyak]

The problem is here. We only match the suffix of the database and don't check validity of the prefix.