Skip to content

Fix collection names with surrounding whitespace being accepted on creation - #28038

Merged
ComfortablyCoding merged 5 commits into
directus:mainfrom
lazerg:fix/28037-collection-name-whitespace
Aug 5, 2026
Merged

Fix collection names with surrounding whitespace being accepted on creation#28038
ComfortablyCoding merged 5 commits into
directus:mainfrom
lazerg:fix/28037-collection-name-whitespace

Conversation

@lazerg

@lazerg lazerg commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

What's Changed

  • createOne now rejects collection names with padding

Tested Scenarios

  • Creating collection with padded collection name rejects
  • Creating collection with non padded name succeeds

Review Notes / Questions / Concerns

  • knex currently auto trims table names but directus does not. Rejecting ensures no mismatch between the two
  • Rejecting also ensures we are not silently changing the requested name

Checklist

Leave unchecked where not applicable

  • Tests added/updated
  • Documentation PR created in directus/docs
  • OpenAPI updated
  • SDK (@directus/sdk) updated to reflect the changes
  • Types (@directus/types) updated to reflect the changes
  • GraphQL schema updated to reflect the changes
  • System data (@directus/system-data) updated for changes to system collections/fields/relations
  • Database migration added for schema/system changes
  • Environment variables documented for new/changed config
  • App translations added for new user-facing strings
  • Security implications apply

Fixes #28037

@lazerg
lazerg requested a review from AlexGaillard as a code owner August 4, 2026 16:49

@kheiner kheiner left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm just a curious person who's looking at PRs to better improve my contributions... Hopefully it's helping others including myself but I have no affiliation with Directus other than wanting to contribute.

Deletion already trims, so a collection created this way could not be deleted under the name it was created with.

I didn't see this in the code, and if the assumption is faulty, wouldn't it make phantom db_tables because functionally things wouldn't be found in the deletion process? I could be wrong here.

Also - is this a good case for a database migration just in case someone has created these tables already?

I know there's a community request feature for the ability to rename collection fields and might be worth ensuring the trim exists everywhere

Comment thread api/src/services/collections.ts
@lazerg

lazerg commented Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

Yeah, i was wrong. I checked deleteOne and the DELETE route: no trim anywhere in the delete path, exact string match only. Edited the PR description with the correction and the actual risk.

Left a migration out of this PR since renaming an already-existing padded collection means renaming its DB table too, and that felt like it deserved its own discussion rather than riding along with a bugfix. Open to adding it here if that's preferred.

@ComfortablyCoding ComfortablyCoding changed the title Fix reserved collection name check bypassed by surrounding whitespace Fix collection names with surrounding whitespace being accepted on creation Aug 5, 2026

@ComfortablyCoding ComfortablyCoding left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@ComfortablyCoding
ComfortablyCoding merged commit bca88f0 into directus:main Aug 5, 2026
98 of 101 checks passed
@github-actions github-actions Bot added this to the Next Release milestone Aug 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Directus v12.1.1 – Reserved Namespace Validation Bypass

3 participants