diff options
| author | wxiaoguang <wxiaoguang@gmail.com> | 2022-11-04 17:04:08 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-11-04 17:04:08 +0800 |
| commit | 2900dc90a792204a02f4a249399f221d3f9b9c52 (patch) | |
| tree | 84758fc47a0b8a76bd56c061b72eb0d869e9b1c3 /modules/validation/helpers.go | |
| parent | 4c6b4a67d9cc5c10c5f40a2420ffc96a6bd9517a (diff) | |
| download | gitea-2900dc90a792204a02f4a249399f221d3f9b9c52.tar.gz gitea-2900dc90a792204a02f4a249399f221d3f9b9c52.zip | |
Improve valid user name check (#20136)
Close https://github.com/go-gitea/gitea/issues/21640
Before: Gitea can create users like ".xxx" or "x..y", which is not
ideal, it's already a consensus that dot filenames have special
meanings, and `a..b` is a confusing name when doing cross repo compare.
After: stricter
Co-authored-by: Jason Song <i@wolfogre.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: delvh <dev.lh@web.de>
Diffstat (limited to 'modules/validation/helpers.go')
| -rw-r--r-- | modules/validation/helpers.go | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/modules/validation/helpers.go b/modules/validation/helpers.go index 484b12b2a2..8e49c7855e 100644 --- a/modules/validation/helpers.go +++ b/modules/validation/helpers.go @@ -91,3 +91,15 @@ func IsValidExternalTrackerURLFormat(uri string) bool { return true } + +var ( + validUsernamePattern = regexp.MustCompile(`^[\da-zA-Z][-.\w]*$`) + invalidUsernamePattern = regexp.MustCompile(`[-._]{2,}|[-._]$`) // No consecutive or trailing non-alphanumeric chars +) + +// IsValidUsername checks if username is valid +func IsValidUsername(name string) bool { + // It is difficult to find a single pattern that is both readable and effective, + // but it's easier to use positive and negative checks. + return validUsernamePattern.MatchString(name) && !invalidUsernamePattern.MatchString(name) +} |