fix: add check for trailing/leading whitespace in project role group …

…names (#10919) (#10988)

* fix: add check for trailing/leading whitespace in project role group names

Signed-off-by: Ferenc <ferenc.horvay@web.de>

* fix: change expected output on whitespace test

Signed-off-by: Ferenc <ferenc.horvay@web.de>

* fix: apply requested changes

Signed-off-by: Ferenc <ferenc.horvay@web.de>

Signed-off-by: Ferenc <ferenc.horvay@web.de>

pkg/apis/application/v1alpha1/types.go

@@ -14,6 +14,7 @@ import (
 	"strconv"
 	"strings"
 	"time"
+	"unicode"
 
 	"github.com/argoproj/gitops-engine/pkg/health"
 	synccommon "github.com/argoproj/gitops-engine/pkg/sync/common"
@@ -1618,20 +1619,26 @@ func validateRoleName(name string) error {
 var invalidChars = regexp.MustCompile("[\"\n\r\t]")
 
 func validateGroupName(name string) error {
+	n := []rune(name)
 	name = strings.TrimSpace(name)
 	if len(name) > 1 && strings.HasPrefix(name, "\"") && strings.HasSuffix(name, "\"") {
 		// Remove surrounding quotes for further inspection of the group name
 		name = name[1 : len(name)-1]
 	} else if strings.Contains(name, ",") {
 		return status.Errorf(codes.InvalidArgument, "group '%s' must be quoted", name)
 	}
-
 	if name == "" {
 		return status.Errorf(codes.InvalidArgument, "group '%s' is empty", name)
 	}
 	if invalidChars.MatchString(name) {
 		return status.Errorf(codes.InvalidArgument, "group '%s' contains invalid characters", name)
 	}
+	if len(n) > 1 && unicode.IsSpace(n[0]) {
+		return status.Errorf(codes.InvalidArgument, "group '%s' contains a leading space", name)
+	}
+	if len(n) > 1 && unicode.IsSpace(n[len(n)-1]) {
+		return status.Errorf(codes.InvalidArgument, "group '%s' contains a trailing space", name)
+	}
 	return nil
 }
 

pkg/apis/application/v1alpha1/types_test.go

@@ -651,6 +651,8 @@ func TestAppProject_ValidateGroupName(t *testing.T) {
 		"my,group",
 		"my\ngroup",
 		"my\rgroup",
+		" my:group",
+		"my:group ",
 	}
 	for _, badName := range badGroupNames {
 		p.Spec.Roles[0].Groups = []string{badName}
@@ -2935,7 +2937,7 @@ func Test_validateGroupName(t *testing.T) {
 		{"Normal group name", "foo", true},
 		{"Quoted with commas", "\"foo,bar,baz\"", true},
 		{"Quoted without commas", "\"foo\"", true},
-		{"Quoted with leading and trailing whitespace", "  \"foo\" ", true},
+		{"Quoted with leading and trailing whitespace", "  \"foo\" ", false},
 		{"Empty group name", "", false},
 		{"Empty group name with quotes", "\"\"", false},
 		{"Unquoted with comma", "foo,bar,baz", false},