Escape user names.

magicmark · Dec 29, 2017 · c75b65c · c75b65c
1 parent c631b40
commit c75b65c
Show file tree

Hide file tree

Showing 2 changed files with 55 additions and 21 deletions.
diff --git a/src/lib/watchlist.js b/src/lib/watchlist.js
@@ -41,7 +41,9 @@ export default class WatchList extends LentilBase {
     }
 
     _getRegexForUser(user) {
-        return new RegExp(`(^|\\s)${user}($|:|-|\\s)`, 'i');
+        // Escape regexp special characters allowed in IRC nicks: \^|{}[]
+        const escapedUser = user.replace(/[\\^|{}[\]]/g, '\\$&');
+        return new RegExp(`(^|\\s)${escapedUser}($|[-:\\s])`, 'i');
     }
 
     _buildRegexCache() {

diff --git a/tests/lib/watchlist_test.js b/tests/lib/watchlist_test.js
@@ -38,6 +38,9 @@ describe('WatchList', function () {
                 dave: {
                     email: 'dave@reddwarf.com',
                 },
+                'dave|wfh': {
+                    email: 'dave+wfh@reddwarf.com',
+                },
             };
 
             watchlist.configFilesLoader = {
@@ -65,28 +68,57 @@ describe('WatchList', function () {
         });
     });
 
-    it('#_getRegexForUser should match a user name in a message correctly', function () {
-        const regex = watchlist._getRegexForUser('dave');
-        const validMessages = [
-            'hello dave',
-            'dave',
-            'dave hello',
-            'dave: hello',
-            'hello dave hello',
-            'hello dave- hello',
-        ];
-        const invalidMessage = [
-            'daveaskdjh',
-            'asdkajdave',
-            'asdaddaveasdas',
-        ];
-
-        validMessages.forEach((message) => {
-            chai.assert.isOk(regex.test(message), `Expected "${message}" to match`);
+    describe('#_getRegexForUser', function () {
+        it('should match a user name in a message correctly', function () {
+            const regex = watchlist._getRegexForUser('dave');
+            const validMessages = [
+                'hello dave',
+                'dave',
+                'dave hello',
+                'dave: hello',
+                'hello dave hello',
+                'hello dave- hello',
+            ];
+            const invalidMessage = [
+                'daveaskdjh',
+                'asdkajdave',
+                'asdaddaveasdas',
+            ];
+
+            validMessages.forEach((message) => {
+                chai.assert.isOk(regex.test(message), `Expected "${message}" to match`);
+            });
+
+            invalidMessage.forEach((message) => {
+                chai.assert.isNotOk(regex.test(message), `Expected "${message}" not to match`);
+            });
         });
 
-        invalidMessage.forEach((message) => {
-            chai.assert.isNotOk(regex.test(message), `Expected "${message}" not to match`);
+        it('should escape user names', function () {
+            const regex = watchlist._getRegexForUser('dave|wfh');
+            const validMessages = [
+                'hello dave|wfh',
+                'dave|wfh',
+                'dave|wfh hello',
+                'dave|wfh: hello',
+                'hello dave|wfh hello',
+                'hello dave|wfh- hello',
+            ];
+            const invalidMessage = [
+                'dave|wfhaskdjh',
+                'asdkajdave|wfh',
+                'asdaddave|wfhasdas',
+                'hello dave',
+                'hello wfh',
+            ];
+
+            validMessages.forEach((message) => {
+                chai.assert.isOk(regex.test(message), `Expected "${message}" to match`);
+            });
+
+            invalidMessage.forEach((message) => {
+                chai.assert.isNotOk(regex.test(message), `Expected "${message}" not to match`);
+            });
         });
     });