Merge pull request #386 from urnetwork/username-validation

validates network name is lowercase and alphanumeric

Author: stuartwk

model/network_model.go

@@ -57,6 +57,14 @@ const (
 )
 
 func NetworkCheck(check *NetworkCheckArgs, session *session.ClientSession) (*NetworkCheckResult, error) {
+
+	_, err := validateNetworkName(check.NetworkName)
+	if err != nil {
+		return &NetworkCheckResult{
+			Available: false,
+		}, nil
+	}
+
 	taken := networkNameSearch().AnyAround(session.Ctx, check.NetworkName, 1)
 
 	result := &NetworkCheckResult{
@@ -112,6 +120,36 @@ type NetworkCreateResultError struct {
 	Message string `json:"message"`
 }
 
+func validateNetworkName(networkName string) (string, error) {
+	trimmed := strings.TrimSpace(networkName)
+
+	// to lowercase
+	normalized := strings.ToLower(trimmed)
+
+	// replace spaces with underscores
+	normalized = strings.ReplaceAll(normalized, " ", "-")
+
+	// ensure length is at least 5 characters
+	if len(normalized) < 5 {
+		return "", errors.New("Network name must have at least 5 characters")
+	}
+
+	// ensure length is less than 50 characters
+	if len(normalized) > 50 {
+		return "", errors.New("Network name must be less than 50 characters")
+	}
+
+	// ensure ASCII characters only
+	for _, char := range normalized {
+		if !((char >= 'a' && char <= 'z') || (char >= '0' && char <= '9') || char == '-') {
+			return "", errors.New("Network name must contain only lowercase letters, numbers, and dashes")
+		}
+	}
+
+	return normalized, nil
+
+}
+
 func NetworkCreate(
 	networkCreate NetworkCreateArgs,
 	session *session.ClientSession,
@@ -173,10 +211,19 @@ func NetworkCreate(
 		}
 	}
 
-	// user is create an authenticated network
+	validatedNetworkName, error := validateNetworkName(networkCreate.NetworkName)
+
+	if error != nil {
+		result := &NetworkCreateResult{
+			Error: &NetworkCreateResultError{
+				Message: error.Error(),
+			},
+		}
+		return result, nil
+	}
 
 	// check if the network name is already taken
-	err := checkNetworkNameAvailability(networkCreate.NetworkName, session)
+	err := checkNetworkNameAvailability(validatedNetworkName, session)
 	if err != nil {
 		result := &NetworkCreateResult{
 			Error: &NetworkCreateResultError{
@@ -186,7 +233,7 @@ func NetworkCreate(
 		return result, nil
 	}
 
-	containsProfanity := goaway.IsProfane(networkCreate.NetworkName)
+	containsProfanity := goaway.IsProfane(validatedNetworkName)
 
 	if networkCreate.UserAuth != nil {
 		// user is creating a network via email/phone + pass
@@ -205,6 +252,7 @@ func NetworkCreate(
 			session.Ctx,
 			&networkCreate,
 			userAuth,
+			validatedNetworkName,
 			containsProfanity,
 		)
 
@@ -246,6 +294,7 @@ func NetworkCreate(
 				&networkCreate,
 				containsProfanity,
 				*authJwt,
+				validatedNetworkName,
 				normalJwtUserAuth,
 			)
 
@@ -335,6 +384,7 @@ func NetworkCreate(
 		networkCreateResult := networkCreateWalletAuth(
 			session.Ctx,
 			&networkCreate,
+			validatedNetworkName,
 			containsProfanity,
 		)
 
@@ -424,6 +474,7 @@ type networkCreateResult struct {
 func networkCreateWalletAuth(
 	ctx context.Context,
 	networkCreate *NetworkCreateArgs,
+	validatedNetworkName string,
 	containsProfanity bool,
 ) networkCreateResult {
 
@@ -495,7 +546,7 @@ func networkCreateWalletAuth(
 				VALUES ($1, $2, $3, $4)
 			`,
 			createdNetworkId,
-			networkCreate.NetworkName,
+			validatedNetworkName,
 			createdUserId,
 			containsProfanity,
 		)
@@ -534,6 +585,7 @@ func networkCreateAuthJwt(
 	networkCreate *NetworkCreateArgs,
 	containsProfanity bool,
 	parsedAuthJwt AuthJwt,
+	validatedNetworkName string,
 	normalizedUserAuth string,
 ) networkCreateResult {
 
@@ -609,7 +661,7 @@ func networkCreateAuthJwt(
 				VALUES ($1, $2, $3, $4)
 			`,
 			createdNetworkId,
-			networkCreate.NetworkName,
+			validatedNetworkName,
 			createdUserId,
 			containsProfanity,
 		)
@@ -648,6 +700,7 @@ func networkCreateUserAuth(
 	ctx context.Context,
 	networkCreate *NetworkCreateArgs,
 	userAuth *string,
+	validatedNetworkName string,
 	containsProfanity bool,
 ) networkCreateResult {
 
@@ -741,7 +794,7 @@ func networkCreateUserAuth(
 				VALUES ($1, $2, $3, $4)
 			`,
 			createdNetworkId,
-			networkCreate.NetworkName,
+			validatedNetworkName,
 			createdUserId,
 			containsProfanity,
 		)
@@ -907,12 +960,13 @@ func checkNetworkNameAvailability(
 
 	var existingNetworkId *server.Id
 
-	if len(networkName) < 5 {
-		err = errors.New("Network name must have at least 5 characters")
+	validatedNetworkName, validationErr := validateNetworkName(networkName)
+	if validationErr != nil {
+		err = validationErr
 		return
 	}
 
-	taken := networkNameSearch().AnyAround(session.Ctx, networkName, 1)
+	taken := networkNameSearch().AnyAround(session.Ctx, validatedNetworkName, 1)
 
 	if taken {
 		err = errors.New("Network name not available")
@@ -926,7 +980,7 @@ func checkNetworkNameAvailability(
 			`
 				SELECT network_id FROM network WHERE network_name = $1
 			`,
-			networkName,
+			validatedNetworkName,
 		)
 		server.WithPgResult(result, queryErr, func() {
 			if result.Next() {

model/network_model_test.go

@@ -349,3 +349,45 @@ func TestNetworkUpdate(t *testing.T) {
 
 	})
 }
+
+func TestNetworkNameValidation(t *testing.T) {
+	server.DefaultTestEnv().Run(func() {
+
+		// too short
+		networkName := ""
+		_, err := validateNetworkName(networkName)
+		assert.NotEqual(t, err, nil)
+
+		// too long
+		networkName = "a123456789012345678901234567890123456789012345678901"
+		_, err = validateNetworkName(networkName)
+		assert.NotEqual(t, err, nil)
+
+		/**
+		 * testing special characters
+		 */
+		networkName = "abcde$"
+		_, err = validateNetworkName(networkName)
+		assert.NotEqual(t, err, nil)
+
+		networkName = "abcdeé"
+		_, err = validateNetworkName(networkName)
+		assert.NotEqual(t, err, nil)
+
+		networkName = "東京タワー"
+		_, err = validateNetworkName(networkName)
+		assert.NotEqual(t, err, nil)
+
+		// test spaces
+		networkName = "abc def"
+		expected := "abc-def"
+		validated, err := validateNetworkName(networkName)
+		assert.Equal(t, validated, expected)
+
+		// valid name should pass
+		networkName = "abcdef"
+		_, err = validateNetworkName(networkName)
+		assert.Equal(t, err, nil)
+
+	})
+}